CVE-2023-51470
📋 TL;DR
This vulnerability allows authenticated attackers to perform PHP object injection through deserialization of untrusted data in the Rencontre WordPress dating site plugin. Attackers can execute arbitrary code, potentially leading to complete system compromise. All WordPress sites using Rencontre plugin versions up to 3.11.1 are affected.
💻 Affected Systems
- Rencontre - Dating Site WordPress Plugin
📦 What is this software?
Rencontre by Boiteasite
⚠️ Risk & Real-World Impact
Worst Case
Complete server takeover with remote code execution, data theft, website defacement, and installation of persistent backdoors.
Likely Case
Unauthorized administrative access, data exfiltration of user information, and installation of malware or cryptocurrency miners.
If Mitigated
Limited impact if proper network segmentation, web application firewalls, and least privilege principles are implemented.
🎯 Exploit Status
Exploit requires authenticated access but is relatively simple to execute once authentication is obtained.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.11.2 or later
Vendor Advisory: https://patchstack.com/database/vulnerability/rencontre/wordpress-rencontre-plugin-3-11-1-authenticated-php-object-injection-vulnerability
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins > Installed Plugins. 3. Find Rencontre plugin. 4. Click 'Update Now' if update is available. 5. Alternatively, download version 3.11.2+ from WordPress repository and manually update.
🔧 Temporary Workarounds
Disable Rencontre Plugin
allTemporarily disable the vulnerable plugin until patching is possible
wp plugin deactivate rencontre
Web Application Firewall Rule
allBlock malicious deserialization attempts at the WAF level
🧯 If You Can't Patch
- Restrict plugin access to trusted users only and implement strong authentication controls
- Implement network segmentation to isolate the WordPress instance from critical systems
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin panel > Plugins > Rencontre version. If version is 3.11.1 or earlier, system is vulnerable.Check Version:
wp plugin list --name=rencontre --field=versionVerify Fix Applied:
Verify Rencontre plugin version is 3.11.2 or later in WordPress admin panel.📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to Rencontre plugin endpoints
- PHP error logs containing unserialize() warnings
- Unexpected file creation in wp-content/uploads
Network Indicators:
- HTTP requests with serialized PHP objects in parameters
- Outbound connections to suspicious IPs from WordPress server
SIEM Query:
source="wordpress.log" AND "rencontre" AND ("unserialize" OR "POST" AND status=200)