CVE-2023-3360 PUBLISHED

Weaver Show Posts < 1.8.1 - Admin+ PHP Object Injection

Assigner: WPScan
Reserved: 21.06.2023 Published: 02.09.2026 Updated: 02.09.2026

The Weaver Show Posts WordPress plugin before 1.8.1 unserialises the content of an imported file, which could lead to PHP object injections issues when a high privilege user import a malicious file and a suitable gadget chain is present on the blog.

Metrics

CVSS 3.1

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N
CVSS Score: 3.3

Attack Vector	Network	Scope	Unchanged
Attack Complexity	High	Confidentiality Impact	Low
Privileges Required	High	Integrity Impact	Low
User Interaction	None	Availability Impact	None

CVSS 3.1

Product Status

Vendor	Unknown
Product	Weaver Show Posts
Versions	Default: unaffected affected from 0 to 1.8.1 (excl.)

Credits

Do Xuan Trung finder
WPScan coordinator

References

https://wpscan.com/vulnerability/7f00e126-7c2a-404d-911a-cf5d4c489f5f/

Problem Types

CWE-502 Deserialization of Untrusted Data CWE