The bt_bb_get_grid AJAX action of the Bold Page Builder WordPress plugin prior to 3.1.6 passes user input into the unserialize() function without any validation or sanitisation, which could lead to a PHP Object Injection. Even though the plugin did not contain a suitable gadget to fully exploit the issue, other installed plugins on the blog could allow such issue to be exploited and lead to RCE in some cases.
| Vulnerable Product | Search on Vulmon | Subscribe to Product |
|---|---|---|
bold-themes bold page builder |
Vulmon