CVE-2018-6195

admin/partials/wp-splashing-admin-main.php in the Splashing Images plugin (wp-splashing-images) before 2.1.1 for WordPress allows authenticated (administrator, editor, or author) remote attackers to conduct PHP Object Injection attacks via crafted serialized data in the 'session' HTTP GET parameter to wp-admin/upload.php.

admin/partials/wp-splashing-admin-main.php in the Splashing Images plugin (wp-splashing-images) before 2.1.1 for WordPress allows authenticated (administrator, editor, or author) remote attackers to conduct PHP Object Injection attacks via crafted serialized data in the 'session' HTTP GET parameter to wp-admin/upload.php.

admin/partials/wp-splashing-admin-main.php en el plugin Splashing Images (wp-splashing-images) en versiones anteriores a la 2.1.1 para WordPress permite que atacantes remotos autenticados (administrador, editor o autor) lleven a cabo ataques de inyección de objetos PHP mediante datos serializados manipulados en el parámetro GET HTTP "session" en wp-admin/upload.php.