CVE-2023-1381

The WP Meta SEO WordPress plugin before 4.5.5 does not validate image file paths before attempting to manipulate the image files, leading to a PHAR deserialization vulnerability. Furthermore, the plugin contains a gadget chain which may be used in certain configurations to achieve remote code execution.

• CWE-502

• https://blog.wpscan.com/uncovering-a-phar-deserialization-vulnerability-in-wp-meta-seo-and-escalating-to-rce/Exploit, Third Party Advisory
• https://wpscan.com/vulnerability/f140a928-d297-4bd1-8552-bfebcedba536Exploit, Third Party Advisory
• https://blog.wpscan.com/uncovering-a-phar-deserialization-vulnerability-in-wp-meta-seo-and-escalating-to-rce/Exploit, Third Party Advisory
• https://wpscan.com/vulnerability/f140a928-d297-4bd1-8552-bfebcedba536Exploit, Third Party Advisory

Published

Apr 10, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-1374The Solidres plugin for WordPress is vulnerable to Stored Cr…4.8
• CVE-2023-1375The WP Fastest Cache plugin for WordPress is vulnerable to u…4.3
• CVE-2023-1377The Solidres WordPress plugin through 0.9.4 does not sanitis…6.1
• CVE-2023-1378A vulnerability classified as critical was found in SourceCo…9.8
• CVE-2023-1379A vulnerability was found in SourceCodester Friendly Island …9.8
• CVE-2023-1380A slab-out-of-bound read problem was found in brcmf_get_asso…7.1
• CVE-2023-1382A data race flaw was found in the Linux kernel, between wher…4.7
• CVE-2023-1383An Improper Enforcement of Behavioral Workflow vulnerability…4.3
• CVE-2023-1384The setMediaSource function on the amzn.thin.pl service does…6.1
• CVE-2023-1385Improper JPAKE implementation allows offline PIN brute-forci…8.8
• CVE-2023-1386A flaw was found in the 9p passthrough filesystem (9pfs) imp…7.8
• CVE-2023-1387Grafana is an open-source platform for monitoring and observ…7.5