CVE-2023-52202 – This CVE describes a PHP object injection vulne... (How to Fix)

Q: What is the severity of CVE-2023-52202?

CVE-2023-52202 has a CVSS score of 9.1 (CRITICAL). This CVE describes a PHP object injection vulnerability in the HTML5 MP3 Player with Folder Feedburner Playlist Free WordPress plugin. Attackers can exploit deserialization of untrusted data to execute arbitrary code on affected WordPress sites. All users of this plugin versions up to 2.8.0 are vulnerable.

📋 TL;DR

This CVE describes a PHP object injection vulnerability in the HTML5 MP3 Player with Folder Feedburner Playlist Free WordPress plugin. Attackers can exploit deserialization of untrusted data to execute arbitrary code on affected WordPress sites. All users of this plugin versions up to 2.8.0 are vulnerable.

💻 Affected Systems

Products:

HTML5 MP3 Player with Folder Feedburner Playlist Free WordPress Plugin

Versions: All versions up to and including 2.8.0

Operating Systems: Any OS running WordPress

Default Config Vulnerable: ⚠️ Yes

Notes: Only affects WordPress installations with this specific plugin installed and activated.

📦 What is this software?

Html5 Mp3 Player With Folder Feedburner Playlist Free by Svnlabs

View all CVEs affecting Html5 Mp3 Player With Folder Feedburner Playlist Free →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Remote code execution leading to complete system compromise, data theft, and website defacement.

🟠

Likely Case

Arbitrary code execution allowing attackers to install backdoors, steal sensitive data, or pivot to other systems.

🟢

If Mitigated

Limited impact with proper network segmentation and minimal privileges, but still potential for plugin-level compromise.

🌐 Internet-Facing: HIGH - WordPress plugins are typically internet-facing and this vulnerability can be exploited remotely.

🏢 Internal Only: MEDIUM - Lower risk if WordPress instance is internal-only, but still vulnerable to insider threats or compromised internal systems.

🎯 Exploit Status

Public PoC: ⚠️ Yes

Weaponized: LIKELY

Unauthenticated Exploit: ⚠️ Yes

Complexity: LOW

Public exploit details available on Patchstack, making exploitation straightforward for attackers.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: 2.8.1 or later

Vendor Advisory: https://patchstack.com/database/vulnerability/html5-mp3-player-with-mp3-folder-feedburner-playlist/wordpress-html5-mp3-player-with-folder-feedburner-plugin-2-8-0-php-object-injection-vulnerability

Restart Required: No

Instructions:

1. Log into WordPress admin panel. 2. Navigate to Plugins. 3. Find 'HTML5 MP3 Player with Folder Feedburner Playlist Free'. 4. Click 'Update Now' if update available. 5. If no update available, deactivate and delete the plugin immediately.

🔧 Temporary Workarounds

Disable Plugin

all

Deactivate and remove the vulnerable plugin from WordPress

wp plugin deactivate html5-mp3-player-with-mp3-folder-feedburner-playlist
wp plugin delete html5-mp3-player-with-mp3-folder-feedburner-playlist

WAF Rule

all

Implement WAF rules to block deserialization attempts

Add rule to block requests containing serialized PHP objects in POST/PUT data

🧯 If You Can't Patch

Immediately deactivate and remove the plugin from all WordPress installations
Implement strict network segmentation to isolate WordPress instances from critical systems

🔍 How to Verify

Check if Vulnerable:

Check WordPress admin panel > Plugins for 'HTML5 MP3 Player with Folder Feedburner Playlist Free' version 2.8.0 or earlier

Check Version:

wp plugin get html5-mp3-player-with-mp3-folder-feedburner-playlist --field=version

Verify Fix Applied:

Verify plugin version is 2.8.1 or later, or confirm plugin is completely removed

📡 Detection & Monitoring

Log Indicators:

Unusual POST requests to WordPress admin-ajax.php or plugin endpoints
PHP errors related to unserialize() or object injection

Network Indicators:

HTTP requests containing serialized PHP objects (O: or a: patterns)
Traffic to known exploit payloads

SIEM Query:

source="wordpress.log" AND ("unserialize" OR "admin-ajax.php") AND status=200

📊 Metadata

CVE ID: CVE-2023-52202

CVSS v3 Score: 9.1 (CRITICAL)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

CWE: CWE-502

Published: January 8, 2024

Last Updated: November 21, 2024

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2023-52202, you might also want to check these: