Executive brief
The Weaver Show Posts WordPress plugin allows administrators to import filter configuration files. The plugin unsafely deserializes the contents of uploaded files without validation, enabling a high-privilege user to inject malicious PHP objects that could trigger arbitrary code execution if a suitable gadget chain exists on the WordPress installation.
Technical details
The vulnerability is a PHP object injection (CWE-502) in the file import functionality of Weaver Show Posts. When a user uploads a filter configuration file via the plugin's admin interface, the plugin passes the file content directly to PHP's unserialize() function without validation. An attacker with admin privileges can craft a serialized PHP object that exploits a gadget chain present in WordPress or installed plugins to execute arbitrary code. The attack requires high privilege (admin) user access and depends on the presence of a suitable gadget chain on the target blog. No patch availability information is explicitly stated in the advisory.
Affected products
- Weaver Show Posts before 1.8.1
Timeline
- 2023-09-02: disclosed