CVE-2021-24579 Bold Page Builder < 3.1.6 - PHP Object Injection

2021-08-3014:11:21

CWE-502

WPScan

www.cve.org

cve-2021-24579

bold page builder

php object injection

wordpress plugin

rce

AI Score

Confidence

High

EPSS

0.001

Percentile

42.0%

JSON

The bt_bb_get_grid AJAX action of the Bold Page Builder WordPress plugin before 3.1.6 passes user input into the unserialize() function without any validation or sanitisation, which could lead to a PHP Object Injection. Even though the plugin did not contain a suitable gadget to fully exploit the issue, other installed plugins on the blog could allow such issue to be exploited and lead to RCE in some cases.

CNA Affected

[
  {
    "product": "Bold Page Builder",
    "vendor": "Unknown",
    "versions": [
      {
        "lessThan": "3.1.6",
        "status": "affected",
        "version": "3.1.6",
        "versionType": "custom"
      }
    ]
  }
]