Vulnerability · Published Oct 16, 2023 · Assigned by WPScan
CVE-2023-4971Weaver Xtreme Theme Support < 6.3.1 - Admin+ PHP Object Injection
High 7.2
In plain English
A high-severity security flaw in Weaver Xtreme Theme Support from Unknown. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.2% (higher than 68% of all known vulnerabilities).
Severity (CVSS 3.1)7.2High
Exploit odds (30 days)1.2%top 32.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
The Weaver Xtreme Theme Support WordPress plugin before 6.3.1 unserialises the content of an imported file, which could lead to PHP object injections issues when a high privilege user import a malicious file and a suitable gadget chain is present on the blog.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Unknown | Weaver Xtreme Theme Support | 0 – before 6.3.1 |
References
- https://wpscan.com/vulnerability/421194e1-6c3f-4972-8f3c-de1b9d2bcb13 exploit, vdb-entry, technical-description