Lucene search
HistoryOct 16, 2023 - 8:15 p.m.
CVE-2023-4971
weaver xtreme theme
wordpress
php object injection
high privilege user
malicious file
gadget chain
CVSS3
7.2
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
HIGH
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
EPSS
0.001
Percentile
24.2%
The Weaver Xtreme Theme Support WordPress plugin before 6.3.1 unserialises the content of an imported file, which could lead to PHP object injections issues when a high privilege user import a malicious file and a suitable gadget chain is present on the blog.
Affected configurations
Node
weaverthemeweaver_xtreme_theme_supportRange<6.3.1wordpress
| Vendor | Product | Version | CPE |
|---|---|---|---|
| weavertheme | weaver_xtreme_theme_support | * | cpe:2.3:a:weavertheme:weaver_xtreme_theme_support:*:*:*:*:*:wordpress:*:* |
Related
cvelist
cvelist
cve
cve
CVE-2023-4971
2023-10-16 20:15:17
wpexploit
wpexploit
Weaver Xtreme Theme Support < 6.3.1 - Admin+ PHP Object Injection
2023-09-19 00:00:00
wpvulndb
wpvulndb
Weaver Xtreme Theme Support < 6.3.1 - Admin+ PHP Object Injection
2023-09-19 00:00:00
prion
prion
Design/Logic Flaw
2023-10-16 20:15:00
wordfence
wordfence
CVSS3
7.2
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
HIGH
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
EPSS
0.001
Percentile
24.2%
Related for NVD:CVE-2023-4971