The WP_HTML_Tag_Processor class in WordPress does not implement a __wakeup() method to prevent unserialization. This allows the class to be used as a gadget in a PHP Object Injection (PoP) chain attack. If an attacker can trigger unserialization of untrusted data (e.g. through a vulnerable plugin), the WP_HTML_Tag_Processor class could be... Weiterlesen: A PoP-chain weakness in the HTML API
Intelligence View
⚡ tsecurity.de Intelligence
A PoP-chain weakness in the HTML API
The WP_HTML_Tag_Processor class in WordPress does not implement a __wakeup() method to prevent unserialization. This allows the class to be used as a gadget in…
Social ReaktionenReagiere als Erste:r — dein Feedback zählt!
🔍 CTI & Forensik
2
Cyber Threat Intelligence & Forensik
ATT&CK-Navigator · IoC-Radar · Exploit-Belege
CTI Threat Relationship Graph
Akteure · Techniken · Beziehungen
CVE / Incident Threat Actor Software MITRE ATT&CK CWE Weakness IoC
Powered by tsecurity.de
tsecurity.de Hub
Intelligence Digest — kostenlos Täglich die wichtigsten Security-News · jederzeit abbestellbar
Community Rating & Social Proof
⭐ Leser-Wertung
–
Ø / 5.0
★★★★★
Noch keine Leser-Bewertungen
War diese Seite hilfreich?
0
Powered by tsecurity.de
tsecurity.de Hub
Verwandte Story-Cluster & Quellen (Vektor-KI)
16 Quellen
Dirty Frag v2.0 (ZDI-CAN-33367): Linux Kernel Local Root Zero-Day, Mitigation for CloudLinux
15 weitere Quellen
Ttsecurity.devor 6 Min.CVE-2026-98911 | Linux Kernel up to 6.18.52 dpaa2-switch dpaa2_switch_rx memory corruption (EUVD-2026-108867) Ttsecurity.devor 6 Min.CVE-2026-98910 | Linux Kernel up to 6.6.157/6.12.110/6.18.52 amdkfd drm/amdkfd kfd_dbg_trap_enable race condition (EUVD-2026-108866) Ttsecurity.devor 6 Min.CVE-2026-98909 | Linux Kernel up to 6.18.52 cpsw_new cpsw_probe denial of service (EUVD-2026-108865) Ttsecurity.devor 6 Min.CVE-2026-98908 | Linux Kernel up to 6.6.157/6.12.110/6.18.52 sparx5 sparx5_tc_flower_psfp_setup memory leak (EUVD-2026-108864) Ttsecurity.devor 6 Min.CVE-2026-98907 | Linux Kernel up to 6.18.52 btrfs sb_write_pointer/read_cache_page_gfp race condition (EUVD-2026-108863) Ttsecurity.devor 6 Min.CVE-2026-98906 | Linux Kernel up to 6.12.110/6.18.52 lan966x lan966x_fdma_reload state issue (EUVD-2026-108862)
+9
4 Quellen
CVE-2026-114624 | baserproject BaserCMS up to 5.3.1/5.4.1 Widget-Area Entity unserialize deserialization (EUVD-2026-108995)
3 weitere Quellen
Ttsecurity.devor 6 Min.CVE-2026-114623 | baserproject BaserCMS up to 5.3.1/5.4.1 BcThemeFile config/install.php parseArgs path traversal (EUVD-2026-108994) Ttsecurity.devor 6 Min.CVE-2026-114622 | baserproject BaserCMS up to 5.2.3/5.3.1/5.4.0/5.4.1 Admin API update fullpath path traversal (EUVD-2026-108993) Ttsecurity.devor 6 Min.CVE-2026-114621 | baserproject BaserCMS up to 5.3.1/5.4.1 Admin/Api/Admin Actions contain/conditions/fields/finder/order sql injection (EUVD-2026-108991)
Mehr aus dieser Kategorie
Blättern: Pfeiltasten [ ← ] [ → ] · Tasten j / k · mobil: Wischen
HAND-OFF
Auf Smartphone übergeben (ADVISORY)
Scannen Sie den QR-Code mit der Smartphone-Kamera für sofortigen mobilen Zugriff:
https://tsecurity.de/de/4277725/sichere-programmierung/a-pop-chain-weakness-in-the-html-api/