CVE-2023-4971

Weaver Xtreme Theme Support < 6.3.1 - Admin+ PHP Object Injection

High · published October 16, 2023

CVSS v3.1
7.2
EPSS
1%
Percentile
67.6
In the wild
Unconfirmed
What it is

The Weaver Xtreme Theme Support WordPress plugin before 6.3.1 unserialises the content of an imported file, which could lead to PHP object injections issues when a high privilege user import a malicious file and a suitable gadget chain is present on the blog.

The record
Technical detail
CVSS v3.1
7.2 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.01186 · 67.6th percentile
Published
2023-10-16T19:38Z
EPSS history
Timeline
  • 16 OCT 19:38Z
    Weaver Xtreme Theme Support < 6.3.1 - Admin+ PHP Object Injection
    cvelistv5