PT-2023-16100 · WordPress · Shoplentor

Published 2023-02-21 · Updated 2025-03-12 · CVE-2023-0232

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ShopLentor WordPress plugin versions prior to 2.5.4

Description The issue arises from the plugin unserializing user input from cookies to track viewed products and user data, potentially leading to PHP Object Injection. This could allow an attacker to inject malicious PHP objects, compromising the security of the system.

Recommendations For versions prior to 2.5.4, update to version 2.5.4 or later to resolve the issue. As a temporary workaround, consider disabling the tracking of viewed products and user data via cookies until the update is applied. Restrict access to sensitive data and functions that may be exploited through PHP Object Injection to minimize the risk of exploitation.

Exploit

Fix

Related Identifiers

CVE-2023-0232

Affected Products

Shoplentor

References · 7

• 🔥 https://wpscan.com/vulnerability/1885a708-0e8a-4f4c-8e26-069bebe9a518 · Exploit
• https://osv.dev/vulnerability/CVE-2023-0232 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-0232 · Security Note
• https://plugins.trac.wordpress.org/changeset/2852711/woolentor-addons/trunk/includes/helper-function.php · Patch
• https://t.me/cvenotify/114536 · Telegram Post
• https://t.me/cvenotify/44723 · Telegram Post
• https://t.me/cibsecurity/58579 · Telegram Post