Horizon Alert
Summary of the vulnerability and why it matters
The Boost plugin for WordPress has a critical vulnerability that could allow unauthenticated attackers to inject PHP objects. This could lead to severe consequences like deleting files or executing code, but only if another plugin or theme on the site provides the necessary components for such an attack.
- Attacker can inject PHP objects.
- Exploitation requires a vulnerable POP chain.
- Potential for data loss or code execution.
Attack Path
How an attacker could exploit the issue
An unauthenticated attacker can exploit this vulnerability by sending specially crafted input in a cookie to a WordPress site running a vulnerable version of the Boost plugin. This input is deserialized, allowing the attacker to inject a PHP object if a suitable POP chain is available through another installed plugin or theme. If a POP chain exists, the attacker could potentially perform actions like deleting files or executing code.
- Unauthenticated remote access required.
- Vulnerable surface is cookie deserialization.
- Requires another vulnerable plugin or theme.
Live Threat
Current exploitation, exposure, and threat context
This vulnerability is unlikely to be weaponized by attackers without further conditions. While the plugin is accessible via the web, the PHP Object Injection requires a specific "POP chain" from another plugin or theme to be present on the target system. Without this chain, the injection would have no impact, which significantly reduces its appeal to opportunistic attackers.
- No public exploit available.
- No KEV listing.
- Impact is conditional on other software.
Priority actions
Operational Fix
Recommended remediation, mitigation, and detection steps
Teams should prioritize investigating the Boost plugin for PHP Object Injection, especially if other plugins with POP chains are present. This critical vulnerability could allow unauthenticated attackers to execute code or access sensitive data by deserializing untrusted input via the STYXKEY-BOOST_USER_LOCATION cookie.
- Block deserialization of untrusted input.
- Monitor for unusual file activity or code execution.
- Update Boost plugin to a patched version when available.
