What’s Vulnerable › Vulnerabilities

CVE-2023-1381: WP Meta SEO < 4.5.5 - Author+ PHAR Deserialization

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.7% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2023-04-10 · updated 2026-06-17
• Weakness: CWE-502

Description

The WP Meta SEO WordPress plugin before 4.5.5 does not validate image file paths before attempting to manipulate the image files, leading to a PHAR deserialization vulnerability. Furthermore, the plugin contains a gadget chain which may be used in certain configurations to achieve remote code execution.

Affected products

• joomunited WP Meta SEO: before 4.5.5 — fixed in 4.5.5

How to fix

Upgrade to a fixed version: joomunited WP Meta SEO 4.5.5. Check the vendor advisory for mitigations.

References

• https://blog.wpscan.com/uncovering-a-phar-deserialization-vulnerability-in-wp-meta-seo-and-escalating-to-rce/
• https://wpscan.com/vulnerability/f140a928-d297-4bd1-8552-bfebcedba536
• https://blog.wpscan.com/uncovering-a-phar-deserialization-vulnerability-in-wp-meta-seo-and-escalating-to-rce/
• https://wpscan.com/vulnerability/f140a928-d297-4bd1-8552-bfebcedba536

Get alerted when CVE-2023-1381 or the next vulnerability affects your stack