What the vulnerability does
01Description
The Jetpack CRM plugin for WordPress is vulnerable to PHAR deserialization via the ‘zbscrmcsvimpf’ parameter in the 'zeroBSCRM_CSVImporterLitehtml_app' function in versions up to, and including, 5.3.1. While the function performs a nonce check, steps 2 and 3 of the check do not take any action upon a failed check. These steps then perform a 'file_exists' check on the value of 'zbscrmcsvimpf'. If a phar:// archive is supplied, its contents will be deserialized and an object injected in the execution stream. This allows an unauthenticated attacker to obtain object injection if they are able to upload a phar archive (for instance if the site supports image uploads) and then trick an administrator into performing an action, such as clicking a link.
Explanation of Vulnerability in Simple Terms
02Summary
Jetpack CRM versions up to 5.3.1 contain a deserialization vulnerability that allows attackers to execute arbitrary code on affected sites. An attacker can craft a malicious serialized object that, when deserialized by the plugin, executes code with the privileges of the web server. User interaction is required—typically clicking a malicious link or visiting a compromised page. This affects all sites running the vulnerable plugin version.
What an attacker can do
03Attacker Capabilities
Execute arbitrary code on the site with web server privileges by sending a malicious serialized object.
Potential impact on your site
04Site Impact
Complete site compromise possible, including data theft, malware installation, and loss of availability.
Conditions required to exploit
05Prerequisites
No authentication required. Attacker must trick a user into clicking a link or visiting a page containing the malicious payload.
Key dates
06Disclosure timeline
October 20, 2023
CVE published
April 8, 2026
Record updated
