Vulnerability · Published Dec 4, 2023 · Assigned by WPScan
CVE-2023-5952Welcart e-Commerce < 2.9.5 - Unauthenticated PHP Object Injection
Critical 9.8
In plain English
A critical-severity security flaw in Welcart e-Commerce from Unknown. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.3% (higher than 70% of all known vulnerabilities).
Severity (CVSS NVD)9.8Critical
Exploit odds (30 days)1.3%top 30.4% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
The Welcart e-Commerce WordPress plugin before 2.9.5 unserializes user input from cookies, which could allow unautehtniacted users to perform PHP Object Injection when a suitable gadget is present on the blog
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Unknown | Welcart e-Commerce | 0 – before 2.9.5 |
References
- https://wpscan.com/vulnerability/0acd613e-dbd6-42ae-9f3d-6d6e77a4c1b7 exploit, vdb-entry, technical-description