CVE-2023-4402

CVSS 3.1 Score 9.8 of 10 (high)

Details

Published Oct 20, 2023
Updated: Nov 7, 2023
CWE ID 89

Summary

CVE-2023-4402 is a vulnerability affecting the Essential Blocks plugin for WordPress. This issue allows unauthenticated attackers to inject PHP Objects through deserialization of untrusted input in the get_products function. The vulnerability, present in versions up to 4.2.0, does not involve a POP chain in the affected plugin itself. However, if a POP chain exists in another plugin or theme installed on the target system, an attacker could potentially delete arbitrary files, retrieve sensitive data, or execute code. WordPress users are advised to update to the latest plugin version to mitigate this risk.

Ligh bulbPrevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.

Share

Prioritize, Pinpoint, and Act to Prevent Vulnerability Exploits with Recorded Future

Note: This is just a basic overview providing quick insights into CVE-2023-4402 information. Gain full access to comprehensive CVE data, third party vulnerabilities, compromised credentials and more with Recorded Future
  • Gain complete coverage of your cyber, third party, and physical attack surface
  • Proactively mitigate threats before they turn into costly attacks
  • Make fast, effective, data-driven decisions

Book your demo

Sign in

Back to Vulnerability Database