CVE-2024-9511
CriticalSummary
Wtyczka FluentSMTP – WP SMTP Plugin dla WordPressa jest podatna na wstrzyknięcie obiektów PHP we wszystkich wersjach do i włącznie z 2.2.82, poprzez deserializację niezaufanych danych wejściowych w funkcji 'formatResult'. Umożliwia to nieautoryzowanym atakującym wstrzyknięcie obiektu PHP.
Risk Assessment
Atakujący mogą wykorzystać tę podatność do usunięcia dowolnych plików, pozyskania wrażliwych danych lub wykonania kodu, jeśli na systemie docelowym zainstalowano dodatkowe wtyczki lub motywy, które tworzą łańcuch POP.
Recommendation
Zaleca się aktualizację wtyczki do najnowszej wersji, aby zminimalizować ryzyko związane z tą podatnością oraz monitorowanie systemu pod kątem zainstalowanych wtyczek i motywów, które mogą wprowadzać dodatkowe ryzyko.
Related vulnerabilities
- CVE-2026-83524Critical
A command injection vulnerability was detected in RedPort Optimizer wXa-203, wXa-213, and wXa-223 up to 20260704, affecting the exec function of the file /xgatev1/system/datetime.php in the System Clock component. The attack can be initiated remotely, and the exploit has been publicly disclosed.
- CVE-2026-82971Critical
A command injection vulnerability was found in QVidium Opera11 version 3.3.2a26-Ax4x-opera11, affecting an unknown part of the file /cgi-bin/net_tr.cgi in the CGI Script component, through manipulation of the ipaddr argument. The attack can be initiated remotely, and the exploit has been publicly disclosed. The vendor has ceased operations and no longer supports these products.
- CVE-2026-82954Critical
A path traversal vulnerability was detected in Dokploy up to version 0.29.7, affecting the writeTraefikConfigInPath function in the file packages/server/src/utils/traefik/application.ts of the Settings component, through manipulation of the path argument. The attack can be launched remotely, and the exploit is public.
- CVE-2026-82226Critical
An unauthenticated PHP Object Injection vulnerability was detected in Tickera versions up to 3.6.0.2. This vulnerability may allow an attacker to execute arbitrary code or perform other unauthorized actions.
- CVE-2026-81780Critical
An unauthenticated Arbitrary File Upload vulnerability was detected in Hash Form versions up to 1.4.2. This vulnerability may allow an attacker to upload malicious files to the server.
- CVE-2026-81779Critical
An improper validation of specified quantity in input vulnerability was detected in the Newspapers X theme from version 1.0.46 through 1.0.48, allowing malicious software to be implanted.
- CVE-2026-81763Critical
An unauthenticated SQL Injection vulnerability was detected in Throws SPAM Away versions up to 3.8.2. This vulnerability may allow an attacker to manipulate database queries.
- CVE-2026-81756Critical
An unauthenticated SQL Injection vulnerability was detected in Smart Marketing SMS and Newsletters Forms versions up to 5.1.24. This vulnerability may allow an attacker to manipulate database queries.
- CVE-2026-81293Critical
An unauthenticated SQL Injection vulnerability was detected in WP Data Access versions up to 5.5.81. This vulnerability may allow an attacker to manipulate database queries.
- CVE-2026-53552Critical
Goploy versions up to 1.17.5 fail to verify that a project belongs to the caller's namespace during file operations and project editing. A user with the manager role can read, write, or delete files in any project and change the git remote URL, leading to remote code execution on the next deploy.
Original NVD description (English source)
The FluentSMTP – WP SMTP Plugin with Amazon SES, SendGrid, MailGun, Postmark, Google and Any SMTP Provider plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.2.82 via deserialization of untrusted input in the 'formatResult' function. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code. The vulnerability was partially patched in version 2.2.82.