security1 distinct publisher
GiveWP issues accounts to unauthenticated attackers on sites where registration is off
Patchstack chained an unsafe unserialize helper, a donation form and a bundled gadget chain into command execution on more than 100,000 installs. Version 4.16.7.2 closes the execution path and leaves the registration hole.
Publishers:bleepingcomputer.com
Reality
- Evidence62
- Adoption38
- Hype gap+18
- Incentives70