Vulnerability · Published May 30, 2023 · Assigned by WPScan
CVE-2023-2288Otter - Gutenberg Blocks < 2.2.6 - Author+ PHAR Deserialization
High 8.8
In plain English
A high-severity security flaw in Otter from Unknown. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 18.0% (higher than 97% of all known vulnerabilities).
Severity (CVSS 3.1)8.8High
Exploit odds (30 days)18.0%top 2.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
The Otter WordPress plugin before 2.2.6 does not sanitize some user-controlled file paths before performing file operations on them. This leads to a PHAR deserialization vulnerability on PHP < 8.0 using the phar:// stream wrapper.
Affected products (as reported)
References
- https://wpscan.com/vulnerability/93acb4ee-1053-48e1-8b69-c09dc3b2f302 exploit, vdb-entry, technical-description