CVE-2023-6049

PoC —

CVSS 3.1

9.8 critical

EPSS

<1%p59

Published

Jan 15, 2024 (Jan 15, 2024)

Modified

Jun 17, 2026

Description

The Estatik Real Estate Plugin WordPress plugin before 4.1.1 unserializes user input via some of its cookies, which could allow unauthenticated users to perform PHP Object Injection when a suitable gadget chain is present on the blog

Vendors: estatik
Products: estatik
Ecosystems: WordPress
Weakness: CWE-502
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (0.9%)

In the news0 stories

No ingested article mentions this CVE yet.