CVE-2023-4402

Summary

CVE-2023-4402 is a vulnerability affecting the Essential Blocks plugin for WordPress. This issue allows unauthenticated attackers to inject PHP Objects through deserialization of untrusted input in the get_products function. The vulnerability, present in versions up to 4.2.0, does not involve a POP chain in the affected plugin itself. However, if a POP chain exists in another plugin or theme installed on the target system, an attacker could potentially delete arbitrary files, retrieve sensitive data, or execute code. WordPress users are advised to update to the latest plugin version to mitigate this risk.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.