Vulnerability in Phlox theme plugin allows attackers to inject PHP objects via deserialization of untrusted input

CVE-2023-7064

Summary

The Phlox theme plugin for WordPress is affected by a PHP Object Injection vulnerability that allows authenticated attackers to exploit the deserialization of untrusted input from the 'id' parameter in the 'auxin_template_control_importer' function. Versions prior to 2.15.2 are susceptible, enabling attackers who can upload a separate PHAR payload as an image file to inject malicious PHP objects. Although no payload operation chain exists within the plugin itself, if a payload operation chain is introduced through other plugins or themes on the same system, it could lead to significant risks including arbitrary file deletion, unauthorized data retrieval, or code execution.

References