CVE-2023-52181CWE-502

WordPress Theme per user Plugin <= 1.0.1 is vulnerable to PHP Object Injection

Critical · published December 31, 2023

CVSS v3.1
10.0
EPSS
1%
Percentile
50.4
In the wild
Unconfirmed
What it is

🔥 A single rogue data packet can unleash chaos! The deserialization vulnerability in Presslabs Theme per user means attackers can send crafted data to execute arbitrary code. ⚡ Think of it like a chef who blindly accepts any ingredient without checking the recipe. If a malicious user sends a specially crafted dish, the chef might serve something toxic instead of a delightful meal! This could lead to an attacker taking full control of your site—think data destruction, unauthorized access, and a compromised user experience. In the wrong hands, it’s absolutely devastating!

Put simply

Think of it like a chef who blindly accepts any ingredient without checking the recipe. If a malicious user sends a specially crafted dish, the chef might serve something toxic instead of a delightful meal! The vulnerability allows untrusted data to be deserialized without proper validation in Presslabs Theme per user versions up to 1.0.1. This could lead to remote code execution if the attacker crafts the serialized data carefully.

What to do

This could lead to an attacker taking full control of your site—think data destruction, unauthorized access, and a compromised user experience. In the wrong hands, it’s absolutely devastating! Patch immediately to the latest version of Presslabs Theme per user. Regularly audit any data handling processes and ensure proper data validation and sanitization are implemented to avoid this risk. You've got this! Follow these steps, and you'll have your system fortified in no time! 🛡️

The record
Technical detail
CVSS v3.1
10.0 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00646 · 50.4th percentile
Weakness
CWE-502 · Deserialization of Untrusted Data
Published
2023-12-31T10:07Z
EPSS history
Timeline
  • 31 DEC 10:07Z
    WordPress Theme per user Plugin <= 1.0.1 is vulnerable to PHP Object Injection
    cvelistv5