The Ad Inserter WordPress plugin before 2.7.27 unserializes user input provided via the settings, which could allow high privilege users such as admin to perform PHP Object Injection when a suitable gadget is present
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Ad_inserter | Ad_inserter_project | * | 2.7.27 (excluding) |