CVE-2023-1381

WP Meta SEO < 4.5.5 - Author+ PHAR Deserialization

High · published April 10, 2023

CVSS v3.1
8.8
EPSS
2%
Percentile
76.9
In the wild
Unconfirmed
What it is

The WP Meta SEO WordPress plugin before 4.5.5 does not validate image file paths before attempting to manipulate the image files, leading to a PHAR deserialization vulnerability. Furthermore, the plugin contains a gadget chain which may be used in certain configurations to achieve remote code execution.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.01689 · 76.9th percentile
Published
2023-04-10T14:14Z
EPSS history
Timeline
  • 10 APR 14:14Z
    WP Meta SEO < 4.5.5 - Author+ PHAR Deserialization
    cvelistv5