CVE-2023-6049: Estatik Real Estate Plugin < 4.1.1 - Unauthenticated PHP Object Injection

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.9% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2024-01-15 · updated 2026-06-17
Weakness: CWE-502

Description

The Estatik Real Estate Plugin WordPress plugin before 4.1.1 unserializes user input via some of its cookies, which could allow unauthenticated users to perform PHP Object Injection when a suitable gadget chain is present on the blog

Affected products

Estatik Real Estate Plugin: before 4.1.1 — fixed in 4.1.1

How to fix

Upgrade to a fixed version: Estatik Real Estate Plugin 4.1.1. Check the vendor advisory for mitigations.

References

https://wpscan.com/vulnerability/8cfd8c1f-2834-4a94-a3fa-c0cfbe78a8b7
https://wpscan.com/vulnerability/8cfd8c1f-2834-4a94-a3fa-c0cfbe78a8b7

Get alerted when CVE-2023-6049 or the next vulnerability affects your stack