Vulnerability · Published May 2, 2023 · Assigned by WPScan
CVE-2023-1669SEOPress < 6.5.0.3 - Admin+ PHP Object Injection
High 7.2
In plain English
A high-severity unsafe deserialization in SEOPress from Unknown. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 17.7% (higher than 97% of all known vulnerabilities).
Severity (CVSS 3.1)7.2High
Exploit odds (30 days)17.7%top 2.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
The SEOPress WordPress plugin before 6.5.0.3 unserializes user input provided via the settings, which could allow high-privilege users such as admin to perform PHP Object Injection when a suitable gadget is present.
Affected products (as reported)
Weakness: CWE-502 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
References
- https://wpscan.com/vulnerability/fb8791f5-2879-431e-9afc-06d5839e4b9d exploit, vdb-entry, technical-description