The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report
The BuddyForms WordPress plugin, in versions prior to 2.7.8, was affected by an unauthenticated insecure deserialization issue. An unauthenticated attacker could leverage this issue to call files using a PHAR wrapper that will deserialize the data and call arbitrary PHP Objects that can be used to perform a variety of malicious actions granted a POP chain is also present.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Buddyforms Plugin | — | Update buddyforms plugin to version 2.7.8, or a newer patched version | May 15, 2025 | Feb 20, 2023 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub