Unauthenticated PHP Object Injection in FundEngine

Executive Summary

This is an unauthenticated PHP Object Injection vulnerability in the FundEngine WordPress plugin versions 1.7.9 and below. It allows attackers to inject malicious PHP objects without needing any user privileges, potentially leading to code execution, SQL injection, or other attacks if a suitable POP chain exists.

Useful 0 Not Useful 0

Detection Guidance

Detecting this vulnerability requires checking if the FundEngine plugin version 1.7.9 or below is installed. Inspect WordPress installations for the plugin directory and compare the version. No direct commands are provided, but monitoring for unusual activity like unexpected code execution or file modifications may indicate exploitation.

Useful 0 Not Useful 0

Impact Analysis

This high-severity vulnerability (CVSS 9.8) can allow attackers to execute arbitrary code, steal data, or disrupt services on your website. Since it is unauthenticated, anyone can exploit it, making it a prime target for mass attacks. Immediate update to version 1.8.0 is required to mitigate risks.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update the FundEngine plugin to version 1.8.0 or later. If updating is not possible, apply the mitigation rule provided by Patchstack to block attacks until the update is completed.

Useful 0 Not Useful 0