VDB
CVE-2024-8514
CVE-2024-8514
PUBLISHED
CVSS 9.100000381469727 CRITICAL
The Prisna GWT – Google Website Translator plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.4.11 via deserialization of untrusted input from the 'prisna_import' parameter. This makes it possible for authenticated attackers, with Administrator-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.
EPSS 1.00% · 61.1th percentile
Risk Scores
CVSS 3.1
9.100000381469727
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
EPSS Score
1.00%
61.1th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| prisna | prisna_gwt-google_website_translator | 0 |
| prisna | Prisna GWT – Google Website Translator | * |
| prisna | google_website_translator | 0 |
Timeline
- Sep 25, 2024 EPSS Score
- Sep 25, 2024 CVE Published
- Oct 5, 2024 Coalition ESS Score
- Nov 4, 2024 EPSS Score
- Nov 23, 2024 EPSS Score
- Jan 3, 2025 EPSS Score
- Jan 23, 2025 EPSS Score
- Mar 3, 2025 EPSS Score
- Mar 19, 2025 EPSS Score
- Mar 20, 2025 EPSS Score
- Mar 24, 2025 EPSS Score
- Mar 28, 2025 EPSS Score
References
- https://www.wordfence.com/threat-intel/vulnerabilities/id/4183c3f7-7794-45f3-8fad-b87ffec3639c?source=cve url
- https://plugins.trac.wordpress.org/browser/google-website-translator/tags/1.4.11/classes/admin.class.php#L267 url
- https://plugins.trac.wordpress.org/changeset/3155285/ url
- https://nvd.nist.gov/vuln/detail/CVE-2024-8514 advisory
- https://plugins.trac.wordpress.org/changeset/3155285 url