CVE-2023-1381highCWE-502

CVE-2023-1381: high-severity vulnerability in WP Meta SEO

WP Meta SEO < 4.5.5 - Author+ PHAR Deserialization

Published · Updated

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 8.8epss 1.7%
exploitation probability
1.7%top 24% of all CVEs
observed exploitation
nono source reports it
The WP Meta SEO WordPress plugin before 4.5.5 does not validate image file paths before attempting to manipulate the image files, leading to a PHAR deserialization vulnerability. Furthermore, the plugin contains a gadget chain which may be used in certain configurations to achieve remote code execution.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected products
Unknown · WP Meta SEO
Related CVEs — WP Meta SEO

In the same product, most dangerous first.

CVE-2023-0875HIGHWP Meta SEO < 4.5.3 - Subscriber+ SQLiEPSS 0.9%CVE-2023-0876MEDIUMWP Meta SEO < 4.5.3 - Subscriber+ Improper Authorization causing Arbitrary RedirectEPSS 0.7%CVE-2022-1093—WP Meta SEO < 4.4.7 - Admin+ Stored Cross-Site Scripting via breadcrumbsEPSS 0.6%
References
https://blog.wpscan.com/uncovering-a-phar-deserialization-vulnerability-in-wp-meta-seo-and-escalating-to-rce/https://wpscan.com/vulnerability/f140a928-d297-4bd1-8552-bfebcedba536