CVE-2023-1347
📋 TL;DR
This vulnerability in the Customizer Export/Import WordPress plugin allows authenticated administrators to perform PHP Object Injection by exploiting insecure deserialization of user input. Attackers could execute arbitrary code, potentially leading to complete site compromise. Only WordPress sites using vulnerable versions of this plugin are affected.
💻 Affected Systems
- WordPress Customizer Export/Import Plugin
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete server compromise, data theft, malware installation, or site defacement.
Likely Case
Privilege escalation, arbitrary code execution within WordPress context, or data manipulation.
If Mitigated
Limited impact if proper access controls restrict admin privileges and plugin is isolated.
🎯 Exploit Status
Exploitation requires admin access and a suitable PHP gadget chain. Public exploit details available in security advisories.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 0.9.6
Vendor Advisory: https://wpscan.com/vulnerability/356a5977-c90c-4fc6-98ed-032d5b27f272
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins → Installed Plugins. 3. Find 'Customizer Export/Import'. 4. Click 'Update Now' if available, or manually update to version 0.9.6+. 5. Verify update completed successfully.
🔧 Temporary Workarounds
Disable Plugin
allTemporarily disable the vulnerable plugin until patching is possible.
wp plugin deactivate customizer-export-import
Restrict Admin Access
allImplement strict access controls and review admin user accounts.
🧯 If You Can't Patch
- Remove admin privileges from untrusted users and implement principle of least privilege.
- Implement web application firewall rules to block serialized object payloads.
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin panel → Plugins → Customizer Export/Import → Version. If version is below 0.9.6, system is vulnerable.Check Version:
wp plugin get customizer-export-import --field=versionVerify Fix Applied:
Confirm plugin version is 0.9.6 or higher in WordPress admin panel.📡 Detection & Monitoring
Log Indicators:
- Unusual admin activity, POST requests to plugin endpoints with serialized data, unexpected file writes or process execution.
Network Indicators:
- HTTP requests containing serialized PHP objects to /wp-admin/admin-ajax.php or plugin-specific endpoints.
SIEM Query:
source="wordpress" AND (uri_path="*customizer*" OR plugin="customizer-export-import") AND (http_method="POST" AND content="*O:*" OR content="*C:*")