Unauthenticated PHP Object Injection in Edge Decor <= 2.9 versions.

What to know

What it is

The Edge Decor plugin has a critical vulnerability (CVSS 9.8) allowing unauthenticated PHP Object Injection, which could lead to high impact such as full control, data integrity and availability being compromised.

Affected

{'products': ['Edge Decor'], 'packages': [], 'versions': ['<= 2.9']}

Fix

Check the linked advisory for a fix, but as a minimum, ensure you are running a version greater than 2.9.

Exploitation

No known exploitation