CVE-2023-6049

Estatik Real Estate Plugin < 4.1.1 - Unauthenticated PHP Object Injection

The Estatik Real Estate Plugin WordPress plugin before 4.1.1 unserializes user input via some of its cookies, which could allow unauthenticated users to perform PHP Object Injection when a suitable gadget chain is present on the blog

Affected

Estatik Real Estate Plugin

CVSS v3.1 NVD

9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

0.93% chance of exploitation in the next 30 days, 60th percentile

Published

2024-01-15

Updated

2025-06-03

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/8cfd8c1f-2834-4a94-a3fa-c0cfbe78a8b7

References

• CVE Record
• NVD entry