Carts Guru <= 1.4.5 - PHP Object Injection
criticalThe Carts Guru plugin 1.4.5 for WordPress allows Insecure Deserialization via a cartsguru-source cookie to classes/wc-cartsguru-event-handler.php.
- CVSS:
- 9.8
- Affected:
- up to 1.4.5
- Fixed in:
- 1.4.6
- Disclosed:
- May 7, 2019