The WPtouch WordPress plugin before 4.3.45 unserialises the content of an imported settings file, which could lead to PHP object injections issues when an user import (intentionally or not) a malicious settings file and a suitable gadget chain is present on the blog.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Wptouch | Bravenewcode | * | 4.3.45 (excluding) |