← Vulnerability feed

Vulnerability record · CVE-2024-5488 · published 9 July 2024

CVE-2024-5488: Seopress deserialization of untrusted data vulnerability

Seopress · Seopress

The SEOPress WordPress plugin before 7.9 does not properly protect some of its REST API routes, which combined with another Object Injection vulnerability can allow unauthenticated attackers to unserialize malicious gadget chains, compromising the site if a suitable chain is present.

9.8 CVSS 3.1 Critical EPSS 3.7% · top 10.5% CWE-502 · Deserialization of untrusted data
9.8CVSS 3.1 base score
3.7%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
2References, 2 tagged exploit
17 Jun 2026Last modified by NVD

Description

The SEOPress WordPress plugin before 7.9 does not properly protect some of its REST API routes, which combined with another Object Injection vulnerability can allow unauthenticated attackers to unserialize malicious gadget chains, compromising the site if a suitable chain is present.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://wpscan.com/vulnerability/28507376-ded0-4e1a-b2fc-2182895aa14c/ ExploitThird Party Advisory
https://wpscan.com/vulnerability/28507376-ded0-4e1a-b2fc-2182895aa14c/ ExploitThird Party Advisory

Track CVE-2024-5488 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

8.8CVE-2024-50455Seopress missing authorization vulnerabilityMissing Authorization vulnerability in Benjamin Denis SEOPress wp-seopress allows Exploiting Incorrectly Configured Access Control Security Levels.Th…EPSS 0.36%8.8CVE-2024-50456Seopress missing authorization vulnerabilityMissing Authorization vulnerability in Benjamin Denis SEOPress wp-seopress allows Exploiting Incorrectly Configured Access Control Security Levels.Th…EPSS 0.29%7.2CVE-2023-1669Seopress deserialization of untrusted data vulnerabilityThe SEOPress WordPress plugin before 6.5.0.3 unserializes user input provided via the settings, which could allow high-privilege users such as admin …EPSS 18%6.1CVE-2024-9225Seopress cross-site scripting vulnerabilityThe SEOPress – On-site SEO plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg & remove_query_arg wi…EPSS 0.45%6.1CVE-2024-4900Seopress open redirect vulnerabilityThe SEOPress WordPress plugin before 7.8 does not validate and escape one of its Post settings, which could allow contributor and above role to perfo…EPSS 0.33%5.4CVE-2024-1168Seopress cross-site scripting vulnerabilityThe SEOPress – On-site SEO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's social image URL in all versions up to,…EPSS 0.37%5.4CVE-2024-1134Seopress cross-site scripting vulnerabilityThe SEOPress – On-site SEO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the SEO title and description parameters as well as …EPSS 0.26%5.4CVE-2024-2165Seopress improper input validation vulnerabilityThe SEOPress – On-site SEO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the image alt parameter in all versions up to, and i…EPSS 0.42%

Source: NIST National Vulnerability Database (record CVE-2024-5488), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.