FluentSMTP <=2.2.82 Unauthenticated PHP Object Injection (CVE-2024-9511)

From this webpage screenshot, the following key information about the vulnerability can be obtained: 1. Vulnerability Name: FluentSMTP - WP SMTP Plugin with Amazon SES, SendGrid, MailGun, Postmark, Google and Any SMTP Provider <= 2.2.82 - Unauthenticated PHP Object Injection 2. Score: 9.8 (Critical) 3. CVSS Score: 3.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) 4. CVE ID: CVE-2024-9511 5. Public Release Date: November 22, 2024 6. Update Date: November 23, 2024 7. Researcher: Leo 8. Description: This vulnerability allows an unauthenticated attacker to inject PHP objects by parsing untrusted input in the function. If additional plugins or themes are installed on the target system, the attacker can delete arbitrary files, retrieve sensitive data, or execute code. 9. Affected Versions: <= 2.2.82 10. Fixed Version: 2.2.83 11. Remediation: Update to the fixed version 2.2.83 or higher. 12. Reference Link: plugins.trac.wordpress.org 13. Vulnerability Type: Deserialization of Untrusted Data 14. Vulnerability Type Score: 9.8 (Critical) 15. Vulnerability Type CVSS Score: 3.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) 16. Vulnerability Type CVE ID: CVE-2024-9511 17. Vulnerability Type Public Release Date: November 22, 2024 18. Vulnerability Type Update Date: November 23, 2024 19. Vulnerability Type Researcher: Leo 20. Vulnerability Type Description: This vulnerability allows an unauthenticated attacker to inject PHP objects by parsing untrusted input in the function. If additional plugins or themes are installed on the target system, the attacker can delete arbitrary files, retrieve sensitive data, or execute code. 21. Vulnerability Type Affected Versions: <= 2.2.82 22. Vulnerability Type Fixed Version: 2.2.83 23. Vulnerability Type Remediation: Update to the fixed version 2.2.83 or higher. 24. Vulnerability Type Reference Link: plugins.trac.wordpress.org 25. Vulnerability Type Type: Deserialization of Untrusted Data 26. Vulnerability Type Type Score: 9.8 (Critical) 27. Vulnerability Type Type CVSS Score: 3.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) 28. Vulnerability Type Type CVE ID: CVE-2024-9511 29. Vulnerability Type Type Public Release Date: November 22, 2024 30. Vulnerability Type Type Update Date: November 23, 2024 31. Vulnerability Type Type Researcher: Leo 32. Vulnerability Type Type Description: This vulnerability allows an unauthenticated attacker to inject PHP objects by parsing untrusted input in the function. If additional plugins or themes are installed on the target system, the attacker can delete arbitrary files, retrieve sensitive data, or execute code. 33. Vulnerability Type Type Affected Versions: <= 2.2.82 34. Vulnerability Type Type Fixed Version: 2.2.83 35. Vulnerability Type Type Remediation: Update to the fixed version 2.2.83 or higher. 36. Vulnerability Type Type Reference Link: plugins.trac.wordpress.org 37. Vulnerability Type Type Type: Deserialization of Untrusted Data 38. Vulnerability Type Type Type Score: 9.8 (Critical) 39. Vulnerability Type Type Type CVSS Score: 3.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) 40. Vulnerability Type Type Type CVE ID: CVE-2024-9511 41. Vulnerability Type Type Type Public Release Date: November 22, 2024 42. Vulnerability Type Type Type Update Date: November 23, 2024 43. Vulnerability Type Type Type Researcher: Leo 44. Vulnerability Type Type Type Description: This vulnerability allows an unauthenticated attacker to inject PHP objects by parsing untrusted input in the function. If additional plugins or themes are installed on the target system, the attacker can delete arbitrary files, retrieve sensitive data, or execute code. 45. Vulnerability Type Type Type Affected Versions: <= 2.2.82 46. Vulnerability Type Type Type Fixed Version: 2.2.83 47. Vulnerability Type Type Type Remediation: Update to the fixed version 2.2.83 or higher. 48. Vulnerability Type Type Type Reference Link: plugins.trac.wordpress.org 49. Vulnerability Type Type Type Type: Deserialization of Untrusted Data 50. Vulnerability Type Type Type Type Score: 9.8 (Critical) 51. Vulnerability Type Type Type Type CVSS Score: 3.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) 52. Vulnerability Type Type Type Type CVE ID: CVE-2024-9511 53. Vulnerability Type Type Type Type Public Release Date: November 22, 2024 54. Vulnerability Type Type Type Type Update Date: November 23, 2024 55. Vulnerability Type Type Type Type Researcher: Leo 56. Vulnerability Type Type Type Type Description: This vulnerability allows an unauthenticated attacker to inject PHP objects by parsing untrusted input in the function. If additional plugins or themes are installed on the target system, the attacker can delete arbitrary files, retrieve sensitive data, or execute code. 57. Vulnerability Type Type Type Type Affected Versions: <= 2.2.82 58. Vulnerability Type Type Type Type Fixed Version: 2.2.83 59. Vulnerability Type Type Type Type Remediation: Update to the fixed version 2.2.83 or higher. 60. Vulnerability Type Type Type Type Reference Link: plugin

Goal Reached Thanks to every supporter — we hit 100%!

FluentSMTP <=2.2.82 Unauthenticated PHP Object Injection (CVE-2024-9511)