CVE-2020-35939: High severity pickplugins post grid vulnerability
PHP Object injection vulnerabilities in the Team Showcase plugin before 1.22.16 for WordPress allow remote authenticated attackers to inject arbitrary PHP objects due to insecure unserialization of data supplied in a remotely hosted crafted payload in the source parameter via AJAX. The action must be set to teamimportxmllayouts.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2020-35939?
CVE-2020-35939 is a PHP Object injection vulnerability in the Team Showcase plugin before version 1.22.16 for WordPress.
What is the severity of CVE-2020-35939?
CVE-2020-35939 has a severity rating of 8.8 (high).
How does CVE-2020-35939 work?
CVE-2020-35939 allows remote authenticated attackers to inject arbitrary PHP objects due to insecure unserialization of data supplied in a remotely hosted crafted payload in the source parameter via AJAX.
Which software versions are affected by CVE-2020-35939?
The Team Showcase plugin versions before 1.22.16 for WordPress are affected by CVE-2020-35939.
How can I fix CVE-2020-35939?
To fix CVE-2020-35939, update the Team Showcase plugin to version 1.22.16 or later.