PT-2023-30025 · WordPress · Enable Media Replace

0Xp1P3 + 1 · Published 2023-10-16 · Updated 2023-10-20 · CVE-2023-4643

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Enable Media Replace WordPress plugin versions prior to 4.1.3

Description The issue allows Author+ users to perform PHP Object Injection when a suitable gadget is present on the blog, due to the unserialize of user input via the Remove Background feature.

Recommendations For versions prior to 4.1.3, update to version 4.1.3 or later to resolve the issue. As a temporary workaround, consider restricting access to the Remove Background feature for Author+ users until the update is applied.

Exploit

Fix

Related Identifiers

CVE-2023-4643

Affected Products

Enable Media Replace

References · 5

• 🔥 https://wpscan.com/vulnerability/d9125604-2236-435c-a67c-07951a1fc5b1 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-4643 · Security Note
• https://osv.dev/vulnerability/CVE-2023-4643 · Vendor Advisory
• https://twitter.com/CVEnew/status/1714006544952488243 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1714060374775886079 · Twitter Post