SQL Injection + Insecure Deserialization leads to Remote Code Execution on https://krisp.ai

Summary

tenweb-speed-optimizer wordpress plugin by 10web.io, prior to 2.12.22 version was vulnerable to UNAUTHENTICATED SQL injection (in /wp-json/tenwebio/v2/compress-one) which could be chained with insecure deserialization in the plugin to gain RCE. Vendor published the issue as an "authenticated" one (update: wordfence team corrected it !) - here. We would like to thank @mikemyers for reporting it responsibly to us.