This is a summary of the AI-generated 10-question deep analysis. The full version (longer answers, follow-up Q&A, related CVEs) requires login. Read the full analysis →
Q1What is this vulnerability? (Essence + Consequences)
🚨 **Essence**: A critical PHP Object Injection flaw in the Woo Inquiry plugin. 📉 **Consequences**: Attackers can inject malicious PHP objects via untrusted input in `_ultimate_store_kit_compare_products`.…
🎯 **Affected**: WordPress Plugin **Ultimate Store Kit** by **bdthemes**. 📦 **Version**: **1.6.4** and all previous versions. ⚠️ **Component**: Specifically the `includes/helper.php` file.
Q4What can hackers do? (Privileges/Data)
💀 **Capabilities**: Full Remote Code Execution (RCE). 🔓 **Privileges**: Attackers gain **High** impact on Confidentiality, Integrity, and Availability (CVSS H:H:H).…
🔓 **Threshold**: **LOW**. 🌐 **Access**: Network vector (AV:N), Low Complexity (AC:L), No Privileges Required (PR:N), No User Interaction (UI:N). Any visitor can trigger the exploit without logging in.
Q6Is there a public Exp? (PoC/Wild Exploitation)
🕵️ **Exploit Status**: Public references exist (WordFence, WP Trac). 📜 **PoC**: While specific code isn't in the data, the vulnerability path (`helper.php` line 1103) is documented.…
🔍 **Self-Check**: Scan for **Ultimate Store Kit** plugin version **≤ 1.6.4**. 📂 **File Check**: Look for `_ultimate_store_kit_compare_products` in `wp-content/plugins/ultimate-store-kit/includes/helper.php`.…
🛠️ **Fix**: Yes, an official patch is available. 📝 **Reference**: Revision **3135472** in the WordPress plugin trac. 🔄 **Action**: Update the plugin to the latest version immediately to patch the deserialization flaw.
Q9What if no patch? (Workaround)
🚧 **Workaround**: If patching is delayed, disable the **Woo Inquiry** feature or the specific comparison function.…
🔥 **Priority**: **CRITICAL**. 🚨 **Urgency**: Immediate action required. With CVSS High severity and no auth required, this is a prime target for automated bots. Patch now to prevent RCE.