CVE-2023-1381

Published: Apr 10, 2023Modified: Feb 11, 2025

8.8

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 2.8 / Impact: 5.9

Source: NVD

Description

The WP Meta SEO WordPress plugin before 4.5.5 does not validate image file paths before attempting to manipulate the image files, leading to a PHAR deserialization vulnerability. Furthermore, the plugin contains a gadget chain which may be used in certain configurations to achieve remote code execution.

Affected (1)

Products: Joomunited: Wp Meta Seo

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Joomunited Wp Meta Seo	Before 4.5.5

Related CWEs

Deserialization of Untrusted Data

The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.

References (4)

https://blog.wpscan.com/uncovering-a-phar-deserialization-vulnerability-in-wp-meta-seo-and-escalating-to-rce/

Source: contact@wpscan.com

ExploitThird Party Advisory

https://wpscan.com/vulnerability/f140a928-d297-4bd1-8552-bfebcedba536

Source: contact@wpscan.com

ExploitThird Party Advisory

https://blog.wpscan.com/uncovering-a-phar-deserialization-vulnerability-in-wp-meta-seo-and-escalating-to-rce/

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party Advisory

https://wpscan.com/vulnerability/f140a928-d297-4bd1-8552-bfebcedba536

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party Advisory

Timeline

No history available yet.