CVE-2024-5488

nvd nist nuclei

Published: Jul 9, 2024Modified: Jun 17, 2026

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

The SEOPress WordPress plugin before 7.9 does not properly protect some of its REST API routes, which combined with another Object Injection vulnerability can allow unauthenticated attackers to unserialize malicious gadget chains, compromising the site if a suitable chain is present.

Affected (1)

Products: Seopress: Seopress

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Seopress Seopress	Before 7.9

Related CWEs

Deserialization of Untrusted Data

The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.

References (2)

https://wpscan.com/vulnerability/28507376-ded0-4e1a-b2fc-2182895aa14c/

Source: contact@wpscan.com

ExploitThird Party Advisory

https://wpscan.com/vulnerability/28507376-ded0-4e1a-b2fc-2182895aa14c/

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party Advisory

Timeline

No history available yet.