CVE-2023-6049: Estatik Real Estate Plugin < 4.1.1 - Unauthenticated PHP Object Injection
Published Jan 15, 2024
·Updated
The Estatik Real Estate Plugin WordPress plugin before 4.1.1 unserializes user input via some of its cookies, which could allow unauthenticated users to perform PHP Object Injection when a suitable gadget chain is present on the blog
Affected Software
1 affected component
Estatik Estatik Wordpress<4.1.1
Event History
Jan 15, 2024
CVE Published
via MITRE·03:10 PM
Data Sourced
via MITRE·03:10 PM
DescriptionWeakness
Frequently Asked Questions
1
What is the severity of CVE-2023-6049?
CVE-2023-6049 is a critical vulnerability that allows unauthenticated users to perform PHP Object Injection.
2
How do I fix CVE-2023-6049?
To fix CVE-2023-6049, update the Estatik Real Estate Plugin to version 4.1.1 or later.
3
What type of vulnerability is CVE-2023-6049?
CVE-2023-6049 is a PHP Object Injection vulnerability caused by insecure unserialization of user input.
4
Who is affected by CVE-2023-6049?
CVE-2023-6049 affects users of the Estatik Real Estate Plugin for WordPress versions prior to 4.1.1.
5
Can CVE-2023-6049 be exploited remotely?
Yes, CVE-2023-6049 can be exploited by unauthenticated users remotely due to the failure in validating user input.