CVE-2019-12241

Carts Guru <= 1.4.5 - PHP Object Injection

criticalDeserialization of Untrusted Data

9.8

CVSS Score

9.8

CVSS Score

critical

Severity

1.4.6

Patched in

1722d

Time to patch

The Carts Guru plugin 1.4.5 for WordPress allows Insecure Deserialization via a cartsguru-source cookie to classes/wc-cartsguru-event-handler.php.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

High

Confidentiality

High

Integrity

High

Availability

Affected versions<=1.4.5

PublishedMay 7, 2019

Last updatedJanuary 22, 2024

Affected plugincarts-guru

References

Check if your site is affected.

Run a free security audit to detect vulnerable plugins, outdated versions, and misconfigurations.