Skip to content
Sign in
9.8 Critical

CVE-2024-5488 The SEOPress WordPress plugin before 7.9 does not properly protect some of its REST API routes, which combined with…

Description

The SEOPress WordPress plugin before 7.9 does not properly protect some of its REST API routes, which combined with another Object Injection vulnerability can allow unauthenticated attackers to unserialize malicious gadget chains, compromising the site if a suitable chain is present.

Affected products and versions

Product Affected versions Fixed in
SEOPress 7.9 earliest → < 7.9 7.9
SEOPress 7.9 earliest → < 7.9 7.9

Other CVEs of SEOPress

The 6 CVEs of SEOPress →
CVE-2026-108041 SEOPress < 10.4 - Authenticated Stored XSS via Analytics Tracking Settings 7.1 High CVE-2024-4899 The SEOPress WordPress plugin before 7.8 does not sanitise and escape some of its Post settings, which could allow high… 5.0 Medium CVE-2024-4900 The SEOPress WordPress plugin before 7.8 does not validate and escape one of its Post settings, which could allow… 6.1 Medium CVE-2023-6290 The SEOPress WordPress plugin before 7.3 does not sanitise and escape some of its settings, which could allow high… 4.8 Medium
Track this CVE