{"id":18912964,"date":"2026-05-20T00:11:10","date_gmt":"2026-05-20T00:11:10","guid":{"rendered":"https:\/\/wordpress.org\/support\/topic\/security-question-37\/"},"modified":"2026-05-20T00:11:10","modified_gmt":"2026-05-20T00:11:10","slug":"security-question-37","status":"publish","type":"topic","link":"https:\/\/wordpress.org\/support\/topic\/security-question-37\/","title":{"rendered":"Security question"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">Hi,<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Hope you&#8217;re well.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Does using unserialize cause a security issue within your plugin?<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><code>\/updraftplus\/includes\/PEAR\/HTTP\/Request2\/CookieJar.php at line 440<\/code><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Using unserialize is well known for causing remote code execution issues when unserializing untrusted input. This is caused by unserialize&#8217;s support for creation of random PHP objects.<\/p>\n","protected":false},"template":"","class_list":["post-18912964","topic","type-topic","status-publish","hentry"],"jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/wordpress.org\/support\/wp-json\/wp\/v2\/topic\/18912964","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/wordpress.org\/support\/wp-json\/wp\/v2\/topic"}],"about":[{"href":"https:\/\/wordpress.org\/support\/wp-json\/wp\/v2\/types\/topic"}],"version-history":[{"count":0,"href":"https:\/\/wordpress.org\/support\/wp-json\/wp\/v2\/topic\/18912964\/revisions"}],"wp:attachment":[{"href":"https:\/\/wordpress.org\/support\/wp-json\/wp\/v2\/media?parent=18912964"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}