CVE-2015-6828

The tweet_info function in class/__functions.php in the SecureMoz Security Audit plugin 1.0.5 and earlier for WordPress does not use an HTTPS session for downloading serialized data, which allows man-in-the-middle attackers to conduct PHP object injection attacks and execute arbitrary PHP code by modifying the client-server data stream. NOTE: some of these details are obtained from third party information.

• CWE-20

• http://www.openwall.com/lists/oss-security/2015/09/05/4Exploit, Mailing List, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2015/09/06/3Exploit, Mailing List, Third Party Advisory
• https://wpvulndb.com/vulnerabilities/8179Third Party Advisory
• http://www.openwall.com/lists/oss-security/2015/09/05/4Exploit, Mailing List, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2015/09/06/3Exploit, Mailing List, Third Party Advisory
• https://wpvulndb.com/vulnerabilities/8179Third Party Advisory

Published

Sep 16, 2015

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2015-6822The destroy_buffers function in libavcodec/sanm.c in FFmpeg …
• CVE-2015-6823The allocate_buffers function in libavcodec/alac.c in FFmpeg…
• CVE-2015-6824The sws_init_context function in libswscale/utils.c in FFmpe…
• CVE-2015-6825The ff_frame_thread_init function in libavcodec/pthread_fram…
• CVE-2015-6826The ff_rv34_decode_init_thread_copy function in libavcodec/r…
• CVE-2015-6827Cross-site request forgery (CSRF) vulnerability in Auto-Exch…
• CVE-2015-6829Multiple SQL injection vulnerabilities in the getip function…
• CVE-2015-6830libraries/plugins/auth/AuthenticationCookie.class.php in php…
• CVE-2015-6831Multiple use-after-free vulnerabilities in SPL in PHP before…7.3
• CVE-2015-6832Use-after-free vulnerability in the SPL unserialize implemen…
• CVE-2015-6833Directory traversal vulnerability in the PharData class in P…
• CVE-2015-6834Multiple use-after-free vulnerabilities in PHP before 5.4.45…