title: Cooked Pro < 1.7.5.7 - Unauthenticated PHP Object Injection
description: The Cooked Pro WordPress plugin before 1.7.5.7 does not properly validate or sanitize the recipe_args parameter before unserializing it in the cooked_loadmore action, allowing an unauthenticated attacker to trigger a PHP Object injection vulnerability.
problem types: CWE-502 Deserialization of Untrusted Data
affected:
{
vendor: Unknown
product: Cooked Pro
versions:
status: affected, versionType: custom, version: 0, lessThan: 1.7.5.7
defaultStatus: unaffected
}