---
id: 1625
title: "How Serialized Cookies Led to RCE on a WordPress Website"
source_domain: hackerone.com
source_url: "https://www.hackerone.com/blog/how-serialized-cookies-led-rce-wordpress-website"
published_at: "2024-05-09 16:11"
tags: ["bug-bounty", "rce", "nextcloud", "php", "web-security", "wordpress", "cookies", "insecure-deserialization"]
phying_url: "https://phying.com/item/1625"
lang: en
---

# How Serialized Cookies Led to RCE on a WordPress Website

## Summary

A bug bounty write-up details an RCE in Nextcloud's WordPress site caused by insecure PHP deserialization in a custom theme, and explains how to identify, assess, and remediate such flaws.

## Intelligence Metadata

- **Sources:** hackerone.com
- **Published:** 2024-05-09 16:11
- **Original:** https://www.hackerone.com/blog/how-serialized-cookies-led-rce-wordpress-website
- **Phying News:** https://phying.com/item/1625