CVE-2023-27459 HIGH

CVE-2023-27459: WordPress User Registration plugin <= 2.3.2.1 - Authenticated PHP Object Injection vulnerability

Vendor Wpeverest
Product User Registration
Weakness CWE-502 · Unsafe deserialization
Published March 26, 2024
Last update April 28, 2026
View on NVD All CVEs

CVSS base score

7.4/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality Low
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L

What the vulnerability does

01Description

Deserialization of Untrusted Data vulnerability in WPEverest User Registration.This issue affects User Registration: from n/a through 2.3.2.1.

Explanation of Vulnerability in Simple Terms

02Summary

The User Registration plugin for WordPress contains a deserialization vulnerability in versions up to 2.3.2.1. An authenticated attacker can send specially crafted serialized data that the plugin processes without proper validation, potentially leading to unauthorized access, data modification, or service disruption. The vulnerability affects multiple security properties and can impact the broader WordPress installation.

What an attacker can do

03Attacker Capabilities

Read sensitive data, modify site content, or disrupt service availability by submitting malicious serialized input.

Potential impact on your site

04Site Impact

Authenticated users with low privileges can compromise site integrity, confidentiality, or availability without additional interaction.

Conditions required to exploit

05Prerequisites

Attacker must have a valid WordPress user account (low privilege level); no user interaction required.

Key dates

06Disclosure timeline

March 26, 2024 CVE published
April 28, 2026 Record updated

Related vulnerabilities

08Related CVE

CVE-2026-49106 WordPress Integration for Contact Form 7 and Constant Contact plugin <= 1.1.6 - PHP Object Injection vulnerability CVE-2026-49109 WordPress Integration for Salesforce and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms plugin <= 1.4.3 - PHP Object Injection vulnerability CVE-2026-65493 WordPress Dokan Pro plugin <= 5.0.2 - PHP Object Injection vulnerability CVE-2026-12240 Export User Data <= 2.2.6 - Authenticated (Subscriber+) PHP Object Injection to Arbitrary File Deletion via display_name Field CVE-2026-27333 WordPress Paid Videochat Turnkey Site plugin <= 7.3.23 - Deserialization of untrusted data vulnerability