Improperly Controlled Modification of Dynamically-Determined Object Attributes Affecting johnpbloch/wordpress-core package, versions <3.7.38>=3.8.0, <3.8.38>=3.9.0, <3.9.36>=4.0.0, <4.0.35>=4.1.0, <4.1.35>=4.2.0, <4.2.32>=4.3.0, <4.3.28>=4.4.0, <4.4.27>=4.5.0, <4.5.26>=4.6.0, <4.6.23>=4.7.0, <4.7.23>=4.8.0, <4.8.19>=4.9.0, <4.9.20>=5.0.0, <5.0.16>=5.1.0, <5.1.13>=5.2.0, <5.2.15>=5.3.0, <5.3.12>=5.4.0, <5.4.10>=5.5.0, <5.5.9>=5.6.0, <5.6.8>=5.7.0, <5.7.6>=5.8.0, <5.8.4>=5.9.0, <5.9.2
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applicationsSnyk Learn
Learn about Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerabilities in an interactive lesson.
Start learning- Snyk IDSNYK-PHP-JOHNPBLOCHWORDPRESSCORE-8651444
- published22 Jan 2025
- disclosed11 Mar 2022
- creditResearchers from Johns Hopkins University
Introduced: 11 Mar 2022
CVE NOT AVAILABLE CWE-915 (opens in a new tab)How to fix?
Upgrade johnpbloch/wordpress-core to version 3.7.38, 3.8.38, 3.9.36, 4.0.35, 4.1.35, 4.2.32, 4.3.28, 4.4.27, 4.5.26, 4.6.23, 4.7.23, 4.8.19, 4.9.20, 5.0.16, 5.1.13, 5.2.15, 5.3.12, 5.4.10, 5.5.9, 5.6.8, 5.7.6, 5.8.4, 5.9.2 or higher.
Overview
johnpbloch/wordpress-core is a web software you can use to create a website or blog.
Affected versions of this package are vulnerable to Improperly Controlled Modification of Dynamically-Determined Object Attributes through the block editor. An attacker can manipulate the object prototype, leading to potential unauthorized access or modification of data by injecting malicious scripts into the web application.