CVE-2023-2500

The Go Pricing - WordPress Responsive Pricing Tables plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 3.3.19 via deserialization of untrusted input from the 'go_pricing' shortcode 'data' parameter. This allows authenticated attackers, with subscriber-level permissions and above, to inject a PHP Object. No POP chain is present in the vulnerable plugin. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.

• CWE-502
• CWE-502

• https://codecanyon.net/item/go-pricing-wordpress-responsive-pricing-tables/3725820Product
• https://www.wordfence.com/threat-intel/vulnerabilities/id/f7686b11-97a8-4f09-bbfa-d77120cc35b7?source=cveThird Party Advisory
• https://codecanyon.net/item/go-pricing-wordpress-responsive-pricing-tables/3725820Product
• https://www.wordfence.com/threat-intel/vulnerabilities/id/f7686b11-97a8-4f09-bbfa-d77120cc35b7?source=cveThird Party Advisory

Published

May 25, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-24994A vulnerability has been identified in Tecnomatix Plant Simu…7.8
• CVE-2023-24995A vulnerability has been identified in Tecnomatix Plant Simu…7.8
• CVE-2023-24996A vulnerability has been identified in Tecnomatix Plant Simu…7.8
• CVE-2023-24997Deserialization of Untrusted Data vulnerability in Apache So…9.8
• CVE-2023-24998Apache Commons FileUpload before 1.5 does not limit the numb…7.5
• CVE-2023-24999HashiCorp Vault and Vault Enterprise’s approle auth method a…8.1
• CVE-2023-25000HashiCorp Vault's implementation of Shamir's secret sharing …4.7
• CVE-2023-25001A maliciously crafted SKP file in Autodesk Navisworks 2023 a…7.8
• CVE-2023-25002A maliciously crafted SKP file in Autodesk products is used …7.8
• CVE-2023-25003A maliciously crafted pskernel.dll file in Autodesk AutoCAD …7.8
• CVE-2023-25004A maliciously crafted pskernel.dll file in Autodesk products…7.8
• CVE-2023-25005A maliciously crafted DLL file can be forced to read beyond …7.8