CVE-2024-5488critical

CVE-2024-5488: critical vulnerability in SEOPress

SEOPress < 7.9 - Unauthenticated Object Injection

Published · Updated

Follow this CVE+ Monitor SEOPress

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

63Vexday Risk Score

Patch soon. It has a working public exploit.

ssvc Attendcvss 9.8epss 3.7%
The SEOPress WordPress plugin before 7.9 does not properly protect some of its REST API routes, which combined with another Object Injection vulnerability can allow unauthenticated attackers to unserialize malicious gadget chains, compromising the site if a suitable chain is present.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
Unknown · SEOPress
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — SEOPress

In the same product, most dangerous first.

CVE-2023-1669HIGHSEOPress < 6.5.0.3 - Admin+ PHP Object InjectionEPSS 17.7%CVE-2023-6290MEDIUMWP SEO Press < 7.3 - Admin+ Stored XSSEPSS 0.4%CVE-2024-4899MEDIUMSEOPress < 7.8 - Contributor+ Stored XSSEPSS 0.3%CVE-2024-4900MEDIUMSEOPress < 7.8 - Contributor+ Open RedirectEPSS 0.3%CVE-2026-108041HIGHSEOPress < 10.4 - Authenticated Stored XSS via Analytics Tracking SettingsEPSS 0.3%