CVE-2023-4971
📋 TL;DR
This vulnerability in the Weaver Xtreme Theme Support WordPress plugin allows authenticated attackers with high privileges to execute arbitrary PHP code by importing a malicious file. It affects WordPress sites using vulnerable plugin versions, potentially leading to complete site compromise.
💻 Affected Systems
- Weaver Xtreme Theme Support WordPress Plugin
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete site takeover, data theft, malware installation, and server compromise leading to lateral movement within the hosting environment.
Likely Case
Unauthorized administrative access, theme/plugin manipulation, backdoor installation, and data exfiltration from the WordPress database.
If Mitigated
Limited impact if proper user access controls prevent unauthorized imports, but still poses risk from compromised admin accounts.
🎯 Exploit Status
Exploitation requires authenticated admin access and knowledge of available gadget chains in the WordPress environment.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 6.3.1
Vendor Advisory: https://wpscan.com/vulnerability/421194e1-6c3f-4972-8f3c-de1b9d2bcb13
Restart Required: No
Instructions:
1. Log into WordPress admin panel
2. Navigate to Plugins → Installed Plugins
3. Find 'Weaver Xtreme Theme Support'
4. Click 'Update Now' if available
5. If no update button, download version 6.3.1+ from WordPress repository
6. Deactivate, delete old version, upload new version, activate
🔧 Temporary Workarounds
Disable Plugin
allTemporarily disable the vulnerable plugin until patching is possible
wp plugin deactivate weaver-xtreme-theme-support
Restrict Import Capabilities
allRemove file import permissions from non-essential admin users
🧯 If You Can't Patch
- Implement strict access controls limiting plugin import functionality to essential personnel only
- Deploy web application firewall rules to block suspicious file uploads and PHP object injection attempts
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin → Plugins → Weaver Xtreme Theme Support version numberCheck Version:
wp plugin get weaver-xtreme-theme-support --field=versionVerify Fix Applied:
Confirm plugin version is 6.3.1 or higher in WordPress admin panel📡 Detection & Monitoring
Log Indicators:
- Unusual file import activities in WordPress logs
- PHP unserialize errors in web server logs
- Suspicious admin user file uploads
Network Indicators:
- POST requests to plugin import endpoints with serialized data
- Unusual outbound connections after file imports
SIEM Query:
source="wordpress.log" AND "weaver-xtreme" AND ("import" OR "unserialize")