CVE-2023-4971: Weaver Xtreme Theme Support < 6.3.1 - Admin+ PHP Object Injection
Published Oct 16, 2023
·Updated
The Weaver Xtreme Theme Support WordPress plugin before 6.3.1 unserialises the content of an imported file, which could lead to PHP object injections issues when a high privilege user import a malicious file and a suitable gadget chain is present on the blog.
Affected Software
1 affected component
Weavertheme Weaver Xtreme Theme Support Wordpress<6.3.1
Event History
Oct 16, 2023
CVE Published
via MITRE·07:38 PM
Data Sourced
via MITRE·07:38 PM
DescriptionWeakness
Data Sourced
via NVD·08:15 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the vulnerability ID for this vulnerability?
The vulnerability ID for this vulnerability is CVE-2023-4971.
2
What is the severity level of CVE-2023-4971?
CVE-2023-4971 has a severity level of high with a value of 7.2.
3
What is affected by CVE-2023-4971?
The Weaver Xtreme Theme Support WordPress plugin before version 6.3.1 is affected by CVE-2023-4971.
4
How can an attacker exploit CVE-2023-4971?
An attacker can exploit CVE-2023-4971 by importing a malicious file and having a suitable gadget chain present on the blog.
5
Is there a fix available for CVE-2023-4971?
Yes, the fix for CVE-2023-4971 is to update the Weaver Xtreme Theme Support WordPress plugin to version 6.3.1 or higher.