Output validation vulnerability in Go Pricing – WordPress Responsive Pricing Tables 3.3.19

The Go Pricing – WordPress Responsive Pricing Tables plugin for WordPress has a security issue. Versions up to, and including, 3.3.19 are vulnerable to a type of attack called PHP Object Injection. The vulnerability is caused by the plugin’s ‘go_pricing’ shortcode’s ‘data’ parameter not being secure. If an attacker has an account with subscriber-level permissions or higher, they can use this vulnerability to inject a PHP Object. This can cause further damage, such as deleting files, retrieving sensitive data, or executing code. Unfortunately, this plugin does not have a security feature to prevent this type of attack.