SEOPress < 7.9 - Unauthenticated Object Injection
Priority MEDIUM 55CWE-502Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-502.
Summary
The SEOPress WordPress plugin before 7.9 does not properly protect some of its REST API routes, which combined with another Object Injection vulnerability can allow unauthenticated attackers to unserialize malicious gadget chains, compromising the site if a suitable chain is present.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.03744 89th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA and NVD
Fix Fixed SEOPress (Unknown): 7.9
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Unknown | SEOPress | before 7.9 | 7.9 | Patch available | CNA |
- SEOPress VendorUnknown Affected before 7.9 Fixed in 7.9 Patch available CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:seopress:seopress:*:*:*:*:*:wordpress:*:* | before 7.9 | Vulnerable | rainbowgeek |
- cpe:2.3:a:seopress:seopress:*:*:*:*:*:wordpress:*:* Versions before 7.9 Vulnerable ·rainbowgeek
Remediation
- Fix · CNA SEOPress (Unknown) Fixed in 7.9
Timeline
- 2026-10-02 Threatist record created from CVE-2024-5488
- 2026-10-03 Alias added: GHSA-wh6w-2qc6-mq3c
References
More rainbowgeek Seopress vulnerabilities
- TI-2023-01566 SEOPress < 6.5.0.3 - Admin+ PHP Object Injection CVSS 3.1HIGH 7.2
- TI-2023-05773 WP SEO Press < 7.3 - Admin+ Stored XSS CVSS 3.1MEDIUM 4.8
- TI-2024-33888 WordPress SEOPress plugin <= 8.1.1 - Broken Access Control vulnerability CVSS 3.1HIGH 8.8
- TI-2024-33887 WordPress SEOPress plugin <= 8.1.1 - Broken Access Control vulnerability CVSS 3.1HIGH 8.8
- TI-2024-08561 SEOPress – On-site SEO <= 8.1.1 - Reflected Cross-Site Scripting CVSS 3.1MEDIUM 6.1
- TI-2024-02011 SEOPress – On-site SEO <= 7.5.2.1 - Authenticated (Author+) Stored Cross-Site Scripting CVSS 3.1MEDIUM 6.4
Sources
- CVE-2024-5488 · CVE Program
- CVE-2024-5488 · NVD
- FIRST EPSS
- GHSA-wh6w-2qc6-mq3c · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences