CVE-2023-28667 Deserialization in Lead Generated WordPress Plugin
Unauthenticated attackers can achieve remote code execution via insecure deserialization in the Lead Generated WordPress plugin.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-28667?
CVE-2023-28667 is a critical unsafe deserialization vulnerability in Lead Generated WordPress Plugin, published on 22 Mar 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The Lead Generated WordPress Plugin, version <= 1.23, was affected by an unauthenticated insecure deserialization issue. The tve_labels parameter of the tve_api_form_submit action is passed to the PHP unserialize() function without being sanitized or verified, and as a result could lead to PHP object injection, which when combined with certain class implementations / gadget chains could be leveraged to perform a variety of malicious actions granted a POP chain is also present.
Weakness: CWE-502
Which versions are affected by CVE-2023-28667?
It affects 1 product.
Products include Leadgenerated Lead Generated.
How do I fix CVE-2023-28667?
No fix has been published for CVE-2023-28667 yet. Limit exposure of the affected software until one is available.
Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.
Is CVE-2023-28667 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-28667 exists.
Sources
Also known as GHSA-cmvc-r236-g4fp.