CVE-2021-24579CWE-502

Bold Page Builder < 3.1.6 - PHP Object Injection

published August 30, 2021

CVSS
—
EPSS
8%
Percentile
94.9
In the wild
Unconfirmed
What it is

The bt_bb_get_grid AJAX action of the Bold Page Builder WordPress plugin before 3.1.6 passes user input into the unserialize() function without any validation or sanitisation, which could lead to a PHP Object Injection. Even though the plugin did not contain a suitable gadget to fully exploit the issue, other installed plugins on the blog could allow such issue to be exploited and lead to RCE in some cases.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.08215 · 94.9th percentile
Weakness
CWE-502 · Deserialization of Untrusted Data
Published
2021-08-30T14:11Z
EPSS history
Timeline
  • 30 AUG 14:11Z
    Bold Page Builder < 3.1.6 - PHP Object Injection
    cvelistv5