CVE-2023-2497 UserPro <= 5.1.0 - Cross-Site Request Forgery to PHP Object Injection

What is CVE-2023-2497?

CVE-2023-2497 is a high-severity vulnerability in UserPro - Community and User Profile WordPress Plugin, published on 22 Nov 2023. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

The UserPro plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 5.1.0. This is due to missing or incorrect nonce validation on the 'import_settings' function. This makes it possible for unauthenticated attackers to exploit PHP Object Injection due to the use of unserialize() on the user supplied parameter via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

Weakness: CWE-352

Which versions are affected by CVE-2023-2497?

It affects 1 product.

Products include Userproplugin Userpro.

How do I fix CVE-2023-2497?

No fix has been published for CVE-2023-2497 yet. Limit exposure of the affected software until one is available.

Is CVE-2023-2497 being exploited?

There is no known exploitation of CVE-2023-2497 in the wild and no public exploit code.

Other vulnerabilities in UserPro - Community and User Profile WordPress Plugin

• CVE-2024-35700 WordPress UserPro plugin <= 5.1.8 - Unauthenticated Account Takeover vulnerability Critical 9.8
• CVE-2023-2437 UserPro <= 5.1.1 - Authentication Bypass to Administrator Critical 9.8
• CVE-2023-2449 UserPro <= 5.1.1 - Insecure Password Reset Mechanism Critical 9.8
• CVE-2017-16562 Auth bypass in n/a Critical 9.8
• CVE-2023-2440 UserPro <= 5.1.1 - Cross-Site Request Forgery to Privilege Escalation High 8.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-358j-mvxh-xxc8.