CVE-2023-3360 in Weaver Show Posts Plugin
Summary
by MITRE • 09/02/2026
The Weaver Show Posts WordPress plugin before 1.8.1 unserialises the content of an imported file, which could lead to PHP object injections issues when a high privilege user import a malicious file and a suitable gadget chain is present on the blog.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/02/2026
The vulnerability identified in The Weaver Show Posts WordPress plugin prior to version 1.8.1 represents a critical server-side request forgery vector rooted in insecure deserialization practices. Specifically, the flaw exists within the functionality that handles file imports for displaying posts from external sources or custom configurations. When an administrator or any user with high privileges initiates an import process by uploading a serialized PHP data structure, the plugin fails to validate the integrity of this input before passing it directly to PHP's unserialize function. This architectural decision creates a direct pathway for attackers who have obtained administrative credentials or exploited another vulnerability to escalate their access through remote code execution techniques that leverage object injection mechanisms inherent in modern PHP environments.
From a technical perspective, the core issue is classified under CWE-502, which denotes Deserialization of Untrusted Data. The plugin accepts user-supplied input via file uploads and processes it without sufficient sanitization or type checking. In many WordPress installations, particularly those utilizing popular frameworks like Laravel, Symfony, or even standard PHP libraries with specific class definitions, there exist gadget chains—sequences of method calls on existing classes—that can be triggered by manipulating serialized objects. When the maliciously crafted payload is deserialized, these gadgets execute arbitrary code within the context of the web server process. This effectively bypasses traditional input validation controls because the attack does not rely on injecting script tags or SQL commands but rather on exploiting legitimate PHP object behaviors to achieve unintended system operations.
The operational impact of this vulnerability is severe due to its dependency on high-privilege user actions for initial exploitation, yet it remains highly dangerous in environments where administrative accounts may be compromised through phishing, credential stuffing, or other lateral movement techniques. Once the malicious file is imported and deserialized by a privileged account, an attacker can achieve full remote code execution on the underlying server hosting the WordPress instance. This leads to complete compromise of the web application, allowing for data exfiltration, defacement, installation of backdoors, or using the compromised host as a pivot point for further attacks against internal network resources. The reliance on a suitable gadget chain means that exploitability varies based on the specific PHP version and installed plugins, but given the ubiquity of common libraries in WordPress ecosystems, the risk surface is substantial.
Mitigation strategies must prioritize immediate remediation through software updates alongside robust operational security practices. Administrators should upgrade The Weaver Show Posts plugin to version 1.8.1 or later, where this deserialization flaw has been addressed by implementing strict input validation and avoiding direct unserialization of user-controlled data. In cases where upgrading is not immediately feasible, temporary mitigations include disabling the import feature entirely if it is not essential for business operations, restricting file upload permissions to prevent execution of uploaded files, and ensuring that PHP configurations disable dangerous functions such as unserialize when processing external inputs whenever possible. Additionally, implementing a Web Application Firewall with rules targeting known deserialization attack patterns can provide an additional layer of defense against exploitation attempts while the underlying code is being remediated.
This vulnerability aligns with MITRE ATT&CK technique T1059, Command and Scripting Interpreter, specifically when leveraged through PHP execution contexts to run arbitrary commands on the host system. It also reflects aspects of T1190, Exploit Public-Facing Application, as it targets a publicly accessible WordPress plugin requiring authentication but exploiting trust relationships within the application logic. Security teams should audit their environments for similar patterns in other plugins that handle file imports or configuration updates to prevent widespread compromise across multiple services hosted on the same infrastructure. Regular vulnerability scanning and code reviews focusing on deserialization endpoints are essential components of maintaining resilience against this class of persistent threats.