CVE-2023-36381 MEDIUM

CVE-2023-36381: WordPress Zippy Plugin <= 1.6.5 is vulnerable to PHP Object Injection

Vendor Gesundheit Bewegt Gmbh

Product Zippy

Weakness CWE-502 · Unsafe deserialization

Published December 28, 2023

Last update April 28, 2026

View on NVD All CVEs

CVSS base score

6.6/10

Attack vector Network

Attack complexity Low

Privileges required High

User interaction None

Confidentiality Low

Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L

What the vulnerability does

01Description

Deserialization of Untrusted Data vulnerability in Gesundheit Bewegt GmbH Zippy.This issue affects Zippy: from n/a through 1.6.5.

Explanation of Vulnerability in Simple Terms

02Summary

Zippy versions up to 1.6.5 contain a deserialization vulnerability that allows authenticated administrators to execute arbitrary code by providing malicious serialized data. An attacker with high-level privileges can craft input that, when deserialized by the application, runs code on the server. The vulnerability affects confidentiality, integrity, and availability of the site.

What an attacker can do

03Attacker Capabilities

Run arbitrary code on the server with the privileges of the web application.

Potential impact on your site

04Site Impact

A compromised admin account can lead to full site takeover, data theft, or malware installation.

Conditions required to exploit

05Prerequisites

Attacker must have administrator-level access to the Zippy application.

Key dates

06Disclosure timeline

December 28, 2023 CVE published

April 28, 2026 Record updated

External resources

07References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2023-36381 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/502.html AskarLabs — CWE-502 write-up Deserialization of Untrusted Data

Related vulnerabilities