CVE-2023-26326 — n/a / BuddyForms WordPress Plugin

Description (CNA)

The BuddyForms WordPress plugin, in versions prior to 2.7.8, was affected by an unauthenticated insecure deserialization issue. An unauthenticated attacker could leverage this issue to call files using a PHAR wrapper that will deserialize the data and call arbitrary PHP Objects that can be used to perform a variety of malicious actions granted a POP chain is also present.

Affected (CNA)

Vendor / product	Versions
n/a / BuddyForms WordPress Plugin	affected All versions prior to version 2.7.8

CWE

No CWE identifiers supplied.

References

https://www.tenable.com/security/research/tra-2023-7

ADP enrichment

CVE

No English description supplied.

https://www.tenable.com/security/research/tra-2023-7

CISA-ADP

No English description supplied.

No references supplied.