| @@ -335,8 +335,9 @@ | ||
| 335 | 335 | * Get Session |
| 336 | 336 | * |
| 337 | 337 | * Retrieve session variable for a given session key. |
| 338 | 338 | * |
| 339 | + * @since 4.16.7.2 Restrict unserialize to prevent object instantiation. | |
| 339 | 340 | * @since 1.0 |
| 340 | 341 | * @access public |
| 341 | 342 | * |
| 342 | 343 | * @param string $key Session key. |
| @@ -346,9 +347,15 @@ | ||
| 346 | 347 | */ |
| 347 | 348 | public function get( $key, $default = false ) { |
| 348 | 349 | $key = sanitize_key( $key ); |
| 349 | 350 | |
| 350 | - return isset( $this->session[ $key ] ) ? maybe_unserialize( $this->session[ $key ] ) : $default; | |
| 351 | + if ( ! isset( $this->session[ $key ] ) ) { | |
| 352 | + return $default; | |
| 353 | + } | |
| 354 | + | |
| 355 | + $value = $this->session[ $key ]; | |
| 356 | + | |
| 357 | + return is_serialized( $value ) ? unserialize( $value, [ 'allowed_classes' => false ] ) : $value; | |
| 351 | 358 | } |
| 352 | 359 | |
| 353 | 360 | /** |
| 354 | 361 | * Set Session |
