CVE-2021-24857

ToTop Link <= 1.7.1 - Unauthenticated PHP Object Injection

State: Published
Severity: Not scored
Published: Dec 13, 2021
Updated: Aug 3, 2024
Reserved: Jan 14, 2021

Description

The ToTop Link WordPress plugin through 1.7.1 passes base64 encoded user input to the unserialize() PHP function, which could lead to PHP Object injection if a plugin installed on the blog has a suitable gadget chain.

Scores

The record has no CVSS score.

Weaknesses

CWE-502 Deserialization of Untrusted Data

Affected Products

Product	Versions
ToTop LinkUnknown	1.7.1 through 1.7.1Affected

References

https://wpscan.com/vulnerability/518204d8-fbf5-4bfa-9db5-835f908f8d8e

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.