CVE-2023-1347

Deeper analysis

The Customizer Export/Import WordPress plugin before version 0.9.6 is affected by a PHP Object Injection vulnerability (CWE-502). The flaw arises because the plugin unsafely unserializes user-supplied data passed through its settings interface, enabling an attacker to instantiate arbitrary PHP objects when a suitable gadget chain exists in the WordPress environment. The issue is rated 7.2 on CVSS 3.1, reflecting network-accessible attack vector, low attack complexity, and high impact on confidentiality, integrity, and availability.

An authenticated administrator can exploit the weakness by submitting malicious serialized payloads via the plugin settings. Successful exploitation can result in arbitrary object instantiation, which may be leveraged for remote code execution or other post-exploitation actions depending on the presence of usable gadgets in loaded WordPress code or plugins.

Public advisories direct administrators to upgrade the Customizer Export/Import plugin to version 0.9.6 or later, which removes the unsafe unserialize call.

The associated EPSS score rose from a low baseline to a peak of 0.1903, indicating emerging exploitation interest after disclosure, before receding to the current value of 0.0515. No confirmed in-the-wild exploitation campaigns are noted in the available references.