Description

Editor PHP Object Injection in TaxoPress <= 3.51.0 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-18T15:17:09.700Z",
  "pubdate": "2026-08-18T15:17:09.700Z",
  "executiveSummary": "An object injection vulnerability exists in TaxoPress versions up to 3.51.0, categorized as a PHP Object Injection flaw.\nThe vulnerability allows authenticated attackers with editor-level privileges or higher to supply serialized data that is subsequently unserialized by the application without proper validation.\nSuccessful exploitation of this flaw can lead to severe security implications, potentially enabling attackers to achieve arbitrary code execution, execute unauthorized file operations, or trigger other malicious behaviors depending on the presence of compatible gadget chains within the application context.\nThe affected product is TaxoPress, specifically all versions up to and including 3.51.0.\nExploitation requires specific privileges within the vulnerable WordPress installation, namely editor-level access, and relies on the insecure processing of user-supplied serialized input within the vulnerable component.\nRisk implications include full compromise of the underlying application integrity and potential escalation of privileges through carefully constructed gadget chains.",
  "technicalDetails": "The vulnerability stems from insecure deserialization practices within TaxoPress versions 3.51.0 and prior.\nSpecifically, the root cause lies in the handling of input data where user-supplied serialized strings are passed directly into PHP's unserialize() function without adequate sanitization, validation, or cryptographic integrity verification.\nThe vulnerable component processes requests handled by authenticated users possessing editor privileges.\nThe attack flow begins when an attacker with editor-level privileges crafts a malicious serialized payload designed to leverage existing class definitions and magic methods within the WordPress ecosystem or dependent plugins, commonly referred to as gadget chains.\nThe attacker submits this serialized payload via an HTTP request to the vulnerable endpoint within TaxoPress.\nUpon receiving the request, the application reads the input and passes it to the insecure deserialization routine.\nPHP automatically instantiates the objects defined within the payload and invokes magic methods such as __wakeup() or __destruct() if they are present in the loaded classes.\nBy orchestrating specific gadget chains, the attacker can manipulate application flow, resulting in post-exploitation impacts such as arbitrary file deletion, remote code execution, or Server-Side Request Forgery, depending on the available classes within the PHP runtime environment.\nAuthentication is required to reach the vulnerable functionality, specifically restricted to editor roles or higher within the WordPress deployment.\nNetwork exposure is inherent to web applications accessible via standard HTTP/HTTPS protocols."
}