🇰🇷 한글 설명
WP Mail Logging 플러그인 1.15.0 이하 버전에서 PHP Object Injection 취약점이 발견됨. BaseModel 클래스 생성자가 데이터베이스의 모든 속성에 대해 검증 없이 maybe_unserialize() 함수를 호출하여 신뢰할 수 없는 입력을 역직렬화함. 공개 이메일 폼(Contact Form 7 등)을 통해 이중 직렬화된 페이로드를 주입 가능.
💡 쉬운 설명
WordPress 메일 로깅 플러그인에서 악성 코드를 숨긴 데이터를 받아들이는 보안 결함입니다. 공개 접근 가능한 연락처 폼을 통해 공격자가 악의적인 데이터를 주입하면, 관리자가 로그를 볼 때 악성 코드가 실행될 수 있습니다.
🇺🇸 원문 (English)
The WP Mail Logging plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.15.0 via deserialization of untrusted input from the email log message field. This is due to the `BaseModel` class constructor calling `maybe_unserialize()` on all properties retrieved from the database without validation. This makes it possible for unauthenticated attackers to inject a PHP Object by submitting a double-serialized payload through any public-facing form that sends email (e.g., Contact Form 7). When the email is logged and subsequently viewed by an administrator, the malicious payload is deserialized into an arbitrary PHP object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present.
📍 영향받는 시스템
WP Mail Logging plugin for WordPress versions up to and including 1.15.0
⚔️ 공격 벡터
Unauthenticated attacker injects double-serialized PHP object through public forms (e.g., Contact Form 7), payload gets deserialized when administrator views the log
🛡️ 대응 방법
Update WP Mail Logging plugin to version 1.15.1 or later; ensure no POP chains from other plugins/themes are available
🔧 검증 코드
설치된 플러그인 버전이 1.15.0 이하이면 취약점 대상이며, 1.15.1 이상이면 패치됨
wp plugin list --field=name,version 2>/dev/null | grep -i 'mail-logging'