CVE-2021-24579: Bold Page Builder < 3.1.6 - PHP Object Injection
The btbbgetgrid AJAX action of the Bold Page Builder WordPress plugin before 3.1.6 passes user input into the unserialize() function without any validation or sanitisation, which could lead to a PHP Object Injection. Even though the plugin did not contain a suitable gadget to fully exploit the issue, other installed plugins on the blog could allow such issue to be exploited and lead to RCE in some cases.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2021-24579?
CVE-2021-24579 is considered a high severity vulnerability due to its potential for PHP Object Injection.
How do I fix CVE-2021-24579?
To fix CVE-2021-24579, update the Bold Page Builder plugin to version 3.1.6 or later.
What type of vulnerability is CVE-2021-24579?
CVE-2021-24579 is a PHP Object Injection vulnerability caused by improper handling of user input.
Which versions of Bold Page Builder are affected by CVE-2021-24579?
Bold Page Builder versions prior to 3.1.6 are affected by CVE-2021-24579.
Who is impacted by CVE-2021-24579?
Any WordPress site using the Bold Page Builder plugin below version 3.1.6 is vulnerable to CVE-2021-24579.