CVE-2023-1549

EUVD-2023-23783
The Ad Inserter WordPress plugin before 2.7.27 unserializes user input provided via the settings, which could allow high privilege users such as admin to perform PHP Object Injection when a suitable gadget is present
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.2 HIGH
NETWORK
LOW
HIGH
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CISA-ADPADP
7.2 HIGH
NETWORK
LOW
HIGH
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 95%
Affected Products (NVD)
VendorProductVersion
ad_inserter_projectad_inserter
𝑥
< 2.7.27
𝑥
= Vulnerable software versions
References
https://wpscan.com/vulnerability/c94b3a68-673b-44d7-9251-f3590cc5ee9e
https://wpscan.com/vulnerability/c94b3a68-673b-44d7-9251-f3590cc5ee9e