CVE-2023-3360: Weaver Show Posts PHP Object Injection Flaw

CVE-2023-3360 Overview

CVE-2023-3360 affects the Weaver Show Posts WordPress plugin in versions before 1.8.1. The plugin unserializes the content of an imported file without validation. This behavior can lead to PHP object injection when a high-privilege user imports a malicious file and a suitable gadget chain exists on the target blog.

The issue is classified under [CWE-502] Deserialization of Untrusted Data. Exploitation requires administrative-level access and a compatible gadget chain, which limits practical impact but still poses risk in multi-plugin WordPress environments.

Critical Impact

An authenticated high-privilege user can trigger PHP object injection through the plugin's file import functionality, potentially chaining to code execution or data tampering when gadgets are available.

Affected Products

• Weaver Show Posts WordPress plugin versions prior to 1.8.1
• WordPress installations that import files via the plugin's import feature
• WordPress sites hosting additional plugins or themes that expose gadget chains

Discovery Timeline

• 2026-09-02 - CVE-2023-3360 published to the National Vulnerability Database
• 2026-09-02 - Last updated in NVD database

Technical Details for CVE-2023-3360

Vulnerability Analysis

The Weaver Show Posts plugin processes imported files by passing their content directly to PHP's unserialize() function. This function converts serialized PHP data back into live objects. When user-controlled data reaches unserialize(), an attacker can craft input that instantiates arbitrary classes already loaded in the WordPress runtime.

PHP object injection alone does not execute code. Impact depends on the presence of magic methods such as __wakeup(), __destruct(), or __toString() in loaded classes. These methods form gadget chains that attackers can trigger during object reconstruction.

WordPress environments typically load many plugins and themes, increasing the likelihood that a viable gadget chain is available. Successful exploitation can result in file writes, SQL execution, or arbitrary code execution depending on the chain.

Root Cause

The root cause is unsafe deserialization of untrusted input inside the plugin's import handler. The code trusts imported file contents and does not validate structure, signature, or type before calling unserialize(). Safe alternatives such as json_decode() or signed payloads are not used.

Attack Vector

Exploitation requires an authenticated attacker with high privileges, typically an administrator. The attacker must convince a valid high-privilege user to import a crafted file, or the attacker must already control such an account. The attack traverses the network to reach the WordPress admin interface, but authentication and user interaction constraints raise the exploitation bar.

The attacker creates a serialized PHP payload referencing a gadget chain present on the target site. Once imported, the plugin unserializes the payload and triggers the chain during object destruction or method invocation.

See the WPScan Vulnerability Report for the vendor-referenced technical details.

Detection Methods for CVE-2023-3360

Indicators of Compromise

• Unexpected file imports in the Weaver Show Posts plugin admin interface logs
• Presence of serialized PHP payloads such as strings beginning with O: or a: inside uploaded import files
• Creation of new PHP files, unexpected wp_options entries, or modifications to core WordPress files following an import event
• Outbound network connections initiated by the PHP process shortly after an admin import action

Detection Strategies

• Inspect Weaver Show Posts import handlers and log all file contents submitted to unserialize() at the application layer
• Deploy web application firewall rules that flag serialized PHP object markers in multipart file uploads to WordPress admin endpoints
• Compare plugin file hashes against the vendor-released 1.8.1 baseline to confirm patch status

Monitoring Recommendations

• Alert on administrator account activity that includes plugin imports outside normal maintenance windows
• Monitor WordPress wp-content directories for new or modified PHP files following admin sessions
• Correlate PHP error logs with import events to surface deserialization exceptions and class autoload failures

How to Mitigate CVE-2023-3360

Immediate Actions Required

• Update the Weaver Show Posts plugin to version 1.8.1 or later on every WordPress site where it is installed
• Audit administrator accounts and enforce multi-factor authentication to reduce the chance of privileged account compromise
• Review recent plugin import activity for signs of malicious file submission

Patch Information

The vendor addressed CVE-2023-3360 in Weaver Show Posts version 1.8.1. The fix removes the unsafe deserialization path in the import handler. Administrators should apply the update through the WordPress plugin management interface. Refer to the WPScan Vulnerability Report for advisory details.

Workarounds

• Disable the Weaver Show Posts plugin until the 1.8.1 update can be applied
• Restrict the administrator role to a minimal set of trusted users and remove unused high-privilege accounts
• Block file imports at the reverse proxy or WAF layer for the plugin's import endpoint until patching completes