The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to PHP Object Injection via deserialization of the 'post_content' of admin_form posts in all versions up to, and including, 3.28.31. This is due to the use of WordPress's `maybe_unserialize()` function without class restrictions on user-controllable content stored in admin_form post content. This makes it possible for authenticated attackers, with Editor-level access and above, to inject a PHP Object. The additional presence of a POP chain allows attackers to achieve remote code execution.
The Frontend Admin by DynamiApps WordPress plugin versions up to 3.28.31 is vulnerable to PHP Object Injection through unsafe deserialization of admin_form post content, allowing authenticated Editor-level users to execute arbitrary code via a POP chain. Organizations using this plugin should immediately update to patched versions and restrict Editor access to trusted administrators only.
تحتوي إضافة Frontend Admin by DynamiApps على ثغرة حقن كائنات PHP خطيرة تنشأ من استخدام دالة WordPress `maybe_unserialize()` بدون قيود على الفئات عند معالجة محتوى منشورات admin_form التي يتحكم بها المستخدمون. يمكن للمهاجمين الذين لديهم صلاحيات محرر أو أعلى استخدام سلسلة POP موجودة لتحقيق تنفيذ أوامر بعيد على الخادم.
The Frontend Admin by DynamiApps WordPress plugin versions up to 3.28.31 is vulnerable to PHP Object Injection through unsafe deserialization of admin_form post content, allowing authenticated Editor-level users to execute arbitrary code via a POP chain. Organizations using this plugin should immediately update to patched versions and restrict Editor access to trusted administrators only.
Update the Frontend Admin by DynamiApps plugin to version 3.28.32 or later immediately. Restrict Editor-level and above access to trusted administrators only. Review user roles and capabilities in WordPress admin panel. Monitor admin_form post modifications in activity logs. Consider implementing Web Application Firewall (WAF) rules to detect serialized object patterns in POST requests.
قم بتحديث إضافة Frontend Admin من DynamiApps إلى الإصدار 3.28.32 أو أحدث فوراً. قيّد الوصول على مستوى المحرر والأعلى للمسؤولين الموثوقين فقط. راجع أدوار المستخدمين والقدرات في لوحة تحكم WordPress. راقب تعديلات منشورات admin_form في سجلات النشاط. فكر في تنفيذ قواعد جدار الحماية لتطبيقات الويب للكشف عن أنماط الكائنات المسلسلة.