CVE-2023-1381
Assigner: WPScan
Published: 2023-04-10T14:14:39.985Z
State: PUBLISHED
title: WP Meta SEO < 4.5.5 - Author+ PHAR Deserialization
problemTypes: descriptions: description: CWE-502 Deserialization of Untrusted Data
type: CWE
affected: vendor: Unknown
product: WP Meta SEO
versions: status: affected
versionType: custom
version: 0
lessThan: 4.5.5
defaultStatus: unaffected
collectionURL: https://wordpress.org/plugins
descriptions: value: The WP Meta SEO WordPress plugin before 4.5.5 does not validate image file paths before attempting to manipulate the image files, leading to a PHAR deserialization vulnerability. Furthermore, the plugin contains a gadget chain which may be used in certain configurations to achieve remote code execution.
credits: value: Alex Sanford
type: finder
value: WPScan
type: coordinator
source: discovery: EXTERNAL
x_generator: engine: WPScan CVE Generator