Critical · published February 15, 2025
🚨 A sneaky PHP Object Injection sits in the s2Member Pro plugin, and it's wide open for abuse! Unauthenticated attackers can take advantage of this vulnerability across all versions up to 241216. 🔥 Think of it like leaving a delivery box unlocked outside your house. Anyone can walk up and toss in whatever they want, including something that could cause chaos if opened inside your home. An attacker could potentially gain the ability to delete any file, steal sensitive data, or even execute arbitrary code on your system. This is absolutely devastating, as it opens the door for total compromise of your WordPress site!
Think of it like leaving a delivery box unlocked outside your house. Anyone can walk up and toss in whatever they want, including something that could cause chaos if opened inside your home. This vulnerability arises from the deserialization of untrusted input in the 's2member_pro_remote_op' parameter, allowing an attacker to inject a PHP Object into the system. While no known PHP Object Pollution chain is present, additional plugins or themes could amplify the risk significantly.
An attacker could potentially gain the ability to delete any file, steal sensitive data, or even execute arbitrary code on your system. This is absolutely devastating, as it opens the door for total compromise of your WordPress site! Immediately update the s2Member Pro plugin to version 241217 or later to close this hole. Additionally, audit any installed plugins or themes for potential chains that could take advantage of this vulnerability and remove or patch them as needed. You've got this! Secure your site by following these steps and you'll be back in control in no time! 🛡️