CVE-2023-2288

Summary

CVE-2023-2288 is a newly disclosed vulnerability affecting the Otter WordPress plugin before version 2.2.6. The issue arises from the plugin's failure to sanitize certain user-controlled file paths prior to executing file operations. This oversight results in a PHAR (Portable Handler Archive) deserialization vulnerability on PHP versions below 8.0 when using the phar:// stream wrapper. Attackers could exploit this flaw to execute arbitrary code on vulnerable WordPress installations. Users are advised to upgrade to the latest version of the Otter plugin to mitigate this risk.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.