In reviewing reports of vulnerabilities in WordPress plugins to provide our customers with the best data on vulnerabilities in plugins they use, we often find that there are reports for things that don’t appear to be vulnerabilities. For more problematic reports, we release posts detailing why the vulnerability reports are false, but there have been a lot of that we haven’t felt rose to that level. In particular, are items that are not outright false, just the issue is probably more accurately described as a bug. For those that don’t rise to the level of getting their own post, we now place them in a weekly post when we come across them.

Admin+ PHP Object Injection in Starter Templates by Kadence WP

Automattic’s WPScan claimed there had been an admin+ PHP object injection vulnerability in the plugin Starter Templates by Kadence WP. They explained it this way:

The plugin unserialises the content of an imported file, which could lead to PHP object injection issues when an admin import (intentionally or not) a malicious file and a suitable gadget chain is present on the blog.

Presumably they were trying to refer to users with the Administrator role there.

There is no explanation of how they could unintentionally do this.

Based on the proof of concept, the “attacker” would need to be logged in as an Administrator, as they have to have the edit_theme_options capability:

170
171
172
173
174
175
176
177

public static function import_export_requests( $wp_customize ) {
	// Check if user is allowed to change values.
	if ( current_user_can( 'edit_theme_options' ) ) {
		if ( isset( $_REQUEST['kadence-starter-export'] ) ) {
			self::export_data( $wp_customize );
		}
		if ( isset( $_REQUEST['kadence-starter-import'] ) && isset( $_FILES['kadence-starter-import-file'] ) ) {
			self::import_data( $wp_customize );

A valid nonce is also checked for:

247
248
249
250

private static function import_data( $wp_customize ) {
	// Make sure we have a valid nonce.
	if ( ! wp_verify_nonce( $_REQUEST['kadence-starter-import'], 'kadence-starter-importing' ) ) {
		return;

So a logged in Administrator would have to intentionally take an action here. A logged in Administrator normally could do the equivalent of this, so it isn’t really a vulnerability.

The developer did improve security in the version this was claimed to have been fixed this, by restricting the ability for PHP object to occur. That was done by setting the options value allowed_classes to false:

$data = unserialize( $raw, array( 'allowed_classes' => false ) );

This false report was given a CVE id by WPScan, CVE-2022-3679, despite not really being a vulnerability.