CVE-2021-24579
High
Description
The bt_bb_get_grid AJAX action of the Bold Page Builder WordPress plugin before 3.1.6 passes user input into the unserialize() function without any validation or sanitisation, which could lead to a PHP Object Injection. Even though the plugin did not contain a suitable gadget to fully exploit the issue, other installed plugins on the blog could allow such issue to be exploited and lead to RCE in some cases.
SeverityHigh
CVSS8.8
Exploit probability—
Product
Bold-themes Bold Page Builder
PublishedAug 30, 2021
First seenAug 30, 2021
Weakness typeCWE-502Deserialization of untrusted data
How to fix
Update
- bold-themes bold_page_builder3.1.6 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| bold-themes bold_page_builder | v < 3.1.6 | 3.1.6 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.