Subscriber PHP Object Injection in Dynamic User Directory

Executive Summary

This vulnerability is a PHP Object Injection flaw in the WordPress Dynamic User Directory Plugin versions 2.4 and below. Attackers can exploit it to manipulate data processing and execute harmful actions on the server by injecting malicious objects.

Useful 0 Not Useful 0

Detection Guidance

Check if the Dynamic User Directory plugin version 2.4 or below is installed on your WordPress site. Look for unusual server behavior like unexpected data processing or unauthorized actions.

Useful 0 Not Useful 0

Impact Analysis

This high-severity vulnerability (CVSS 9.8) allows attackers to remotely execute code on your server without authentication. It could lead to complete site compromise, data theft, or further attacks on your infrastructure. Mass exploitation campaigns are likely targeting thousands of websites.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized data access or manipulation, potentially violating GDPR and HIPAA compliance by exposing or altering sensitive user data. A CVSS score of 9.8 indicates a high risk of exploitation, which may result in data breaches or unauthorized system access, both of which are critical compliance concerns.

Useful 0 Not Useful 0

Mitigation Strategies

Disable the Dynamic User Directory plugin immediately if installed. Apply Patchstack's mitigation rule if available. Contact your hosting provider or developer for further assistance until an official patch is released.

Useful 0 Not Useful 0