WPSyncSheets plugin unserialization flaw allows remote code execution
A WordPress Google Sheets plugin lets strangers take over the server.
Summary
An untrusted input handling flaw in this WordPress Contact Form 7 Google Sheets plugin lets unauthenticated attackers execute code on the server. All versions are affected; remote code execution requires a Google Sheets access token configured in the plugin.
Affected when
- Google Sheets access token configured in the plugin (needed for code execution)
What to do
No fixed version is named. Check that the plugin is newer than 1.8.0 and read the vendor's advisory.
Products and platforms
CVE IDs
Times
First published
First seen