PHP Object Injection Vulnerability in Essential Blocks Plugin for WordPress

CVE-2023-4386

What is CVE-2023-4386?

The Essential Blocks plugin for WordPress is susceptible to PHP Object Injection due to insecure deserialization of untrusted input in the get_posts function. Attackers who are not authenticated can potentially inject a PHP Object, exploiting the vulnerability in versions up to and including 4.2.0. While the plugin does not inherently possess a Proof of Concept (POP) chain, the presence of such a chain through additional plugins or themes could enable attackers to carry out harmful activities, including modifying or deleting files and accessing sensitive information.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References