PHP Object Injection Vulnerability in Essential Blocks Plugin for WordPress
CVE-2023-4402
8.1HIGH
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 20 October 2023
What is CVE-2023-4402?
The Essential Blocks plugin for WordPress is susceptible to PHP Object Injection due to deserialization of untrusted input within the get_products function. This vulnerability affects versions up to and including 4.2.0. Unauthenticated attackers can exploit this flaw to inject PHP objects, leading to potential risks when a dangerous Object-Property (POP) chain is present via other plugins or themes. Such exploitation could permit attackers to delete files, access sensitive information, or execute malicious code.
Affected Version(s)
Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates * <= 4.2.0
Essential Blocks Pro * <= 1.1.0