Critical · published January 30, 2025
🚨 A sneaky PHP Object Injection vulnerability lurks in the iControlWP Multiple WordPress Site Manager plugin, affecting all versions up to 4.4.5! 🔥 Think of it like a delivery service that accepts parcels without checking the sender — if the right package arrives from an untrusted source, it could contain something harmful that disrupts the whole operation. An unauthenticated attacker could potentially take control of your WordPress site if they manage to exploit this flaw alongside another vulnerable plugin that has a PHP Object Pollution (POP) chain. This means they could delete files, snatch sensitive data, or even execute malicious code, unleashing chaos on your website!
Think of it like a delivery service that accepts parcels without checking the sender — if the right package arrives from an untrusted source, it could contain something harmful that disrupts the whole operation. This vulnerability allows an unauthenticated attacker to inject PHP Objects into the application through the reqpars parameter, which is exploited via deserialization of untrusted input. If a POP chain is present in other installed plugins or themes, the impact can be severe.
An unauthenticated attacker could potentially take control of your WordPress site if they manage to exploit this flaw alongside another vulnerable plugin that has a PHP Object Pollution (POP) chain. This means they could delete files, snatch sensitive data, or even execute malicious code, unleashing chaos on your website! To safeguard your site, update the iControlWP plugin to the latest version immediately — version 4.4.6 or higher. Additionally, review all other installed plugins and themes for potential POP chains and consider disabling or removing any that are risky. You’ve got this! Take these steps now, and you’ll have your WordPress site locked down tighter than a drum! 🛡️