CVE-2023-37390 HIGH

CVE-2023-37390: WordPress Themesflat Addons For Elementor Plugin <= 2.0.0 is vulnerable to PHP Object Injection

Vendor Themesflat
Product Themesflat Addons For Elementor
Weakness CWE-502 · Unsafe deserialization
Published December 19, 2023
Last update April 28, 2026
View on NVD All CVEs

CVSS base score

8.3/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality Low
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L

What the vulnerability does

01Description

Deserialization of Untrusted Data vulnerability in Themesflat Themesflat Addons For Elementor.This issue affects Themesflat Addons For Elementor: from n/a through 2.0.0.

Explanation of Vulnerability in Simple Terms

02Summary

Themesflat Addons For Elementor versions up to 2.0.0 contain a deserialization vulnerability that allows unauthenticated attackers to execute arbitrary code on the site. The plugin unsafely processes serialized data from untrusted sources without proper validation. An attacker can exploit this over the network without user interaction to compromise the entire site.

What an attacker can do

03Attacker Capabilities

Run arbitrary code on the site and take full control without needing a user account.

Potential impact on your site

04Site Impact

Complete site compromise. An attacker can modify content, steal data, install malware, or take the site offline.

Conditions required to exploit

05Prerequisites

None. The attacker can exploit this remotely without authentication or user interaction.

Key dates

06Disclosure timeline

December 19, 2023 CVE published
April 28, 2026 Record updated

Related vulnerabilities

08Related CVE

CVE-2026-39474 WordPress Post Duplicator plugin <= 3.0.10 - PHP Object Injection vulnerability CVE-2026-39434 WordPress CTX Feed plugin <= 6.6.26 - PHP Object Injection vulnerability CVE-2026-15962 Fluent Forms Pro Add On Pack <= 6.2.6 - Authenticated (Subscriber+) PHP Object Injection to Arbitrary User Password Change via User Meta Field CVE-2026-57724 WordPress Kirki plugin <= 6.0.12 - PHP Object Injection vulnerability CVE-2026-49768 WordPress Happyforms plugin <= 1.26.13 - PHP Object Injection vulnerability