Description

Unauthenticated PHP Object Injection in WPBruiser {no- Captcha anti-Spam} <= 3.1.43 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-08-06T15:17:17.803Z",
  "pubdate": "2026-08-06T15:17:17.803Z",
  "executiveSummary": "An unauthenticated PHP Object Injection vulnerability has been identified in the WPBruiser {no-Captcha anti-Spam} plugin affecting versions up to 3.1.43. This security flaw arises from the insecure handling of serialized data passed via user-supplied input to the application, allowing an unauthenticated remote attacker to supply malicious serialized payloads. Successful exploitation of this vulnerability can lead to severe security implications, including potential Remote Code Execution (RCE) depending on the presence of compatible gadget chains within the application environment, unauthorized data access, or denial of service conditions. The flaw poses a significant risk as it requires no prior authentication or administrative privileges, lowering the barrier to entry for potential threat actors targeting vulnerable WordPress installations. Remediation requires updating the affected product beyond version 3.1.43 or applying official vendor patches as soon as they become available.",
  "technicalDetails": "The vulnerability is categorized as PHP Object Injection, stemming from the insecure deserialization of untrusted data within the WPBruiser {no-Captcha anti-Spam} plugin. Specifically, versions 3.1.43 and prior fail to properly sanitize or validate user-supplied input before passing it into PHP's native unserialize() function or an equivalent insecure deserialization mechanism. The root cause lies in the improper handling of serialized objects, which allows attackers to manipulate the data stream processed by the application.\nAttack flow begins with an unauthenticated remote attacker sending a crafted HTTP request containing a malicious serialized PHP payload to the vulnerable endpoint exposed by the plugin. Because no authentication or privilege requirements are enforced for this entry point, the request reaches the vulnerable component directly over the network. Upon receiving the input, the application instantiates the serialized objects without verifying their integrity or class safety.\nDuring the instantiation process, PHP magic methods such as __wakeup() or __destruct() defined within the included classes are automatically invoked. If the application environment or third-party plugins loaded alongside WPBruiser contain exploitable gadget chains, the attacker can leverage these methods to execute arbitrary system commands, read sensitive files, or manipulate application state. The post-exploitation impact is largely determined by the privileges of the web server process and the availability of gadget chains within the PHP scope, potentially granting the attacker complete control over the underlying WordPress site."
}