WP Meta SEO < 4.5.5 - Author+ PHAR Deserialization

CVE-2023-1381

Summary

The WP Meta SEO plugin for WordPress, prior to version 4.5.5, contains a vulnerability that allows the manipulation of image files without valid path verification. This flaw can be exploited to trigger a PHAR deserialization issue, which in certain environments, may lead to remote code execution through a crafted payload. Such vulnerabilities pose significant security risks, enabling attackers to execute arbitrary code on the server hosting the vulnerable plugin.

References