CVE-2023-1381

PoC ×2—

CVSS 3.1

8.8 high

EPSS

2%p76

Published

Apr 10, 2023 (Apr 10, 2023)

Modified

Jun 17, 2026

Description

The WP Meta SEO WordPress plugin before 4.5.5 does not validate image file paths before attempting to manipulate the image files, leading to a PHAR deserialization vulnerability. Furthermore, the plugin contains a gadget chain which may be used in certain configurations to achieve remote code execution.

Vendors: joomunited
Products: wp meta seo
Ecosystems: WordPress
Weakness: CWE-502
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (1.7%)

In the news0 stories

No ingested article mentions this CVE yet.