What’s Vulnerable › Vulnerabilities

CVE-2024-5488: SEOPress < 7.9 - Unauthenticated Object Injection

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 3.7% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2024-07-09 · updated 2026-06-17
• Weakness: CWE-502

Description

The SEOPress WordPress plugin before 7.9 does not properly protect some of its REST API routes, which combined with another Object Injection vulnerability can allow unauthenticated attackers to unserialize malicious gadget chains, compromising the site if a suitable chain is present.

Affected products

• SEOPress: before 7.9 — fixed in 7.9

How to fix

Upgrade to a fixed version: SEOPress 7.9. Check the vendor advisory for mitigations.

References

• https://wpscan.com/vulnerability/28507376-ded0-4e1a-b2fc-2182895aa14c/
• https://wpscan.com/vulnerability/28507376-ded0-4e1a-b2fc-2182895aa14c/

Get alerted when CVE-2024-5488 or the next vulnerability affects your stack