CVE-2023-4386: Essential Blocks <= 4.2.0 - Unauthenticated PHP Object Injection via queries
The Essential Blocks plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 4.2.0 via deserialization of untrusted input in the getposts function. This allows unauthenticated attackers to inject a PHP Object. No POP chain is present in the vulnerable plugin. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2023-4386?
CVE-2023-4386 is a vulnerability in the Essential Blocks plugin for WordPress that allows unauthenticated attackers to inject a PHP Object through deserialization of untrusted input in the get_posts function.
What is the severity of CVE-2023-4386?
CVE-2023-4386 has a severity rating of 8.1, which is considered high.
How does CVE-2023-4386 affect the Essential Blocks plugin?
CVE-2023-4386 affects versions up to and including 4.2.0 of the Essential Blocks plugin for WordPress.
How can an attacker exploit CVE-2023-4386?
An attacker can exploit CVE-2023-4386 by sending untrusted input to the get_posts function, leading to PHP Object Injection.
Is there a patch available for CVE-2023-4386?
Yes, please refer to the official references for the patch and update instructions.