CVE-2023-47507 HIGH

CVE-2023-47507: WordPress Master Slider Pro Plugin <= 3.6.5 is vulnerable to PHP Object Injection

Vendor Master Slider

Product Master Slider Pro

Weakness CWE-502 · Unsafe deserialization

Published December 20, 2023

Last update April 28, 2026

View on NVD All CVEs

CVSS base score

7.1/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction Required

Confidentiality Low

Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

What the vulnerability does

01Description

Deserialization of Untrusted Data vulnerability in Master Slider Master Slider Pro.This issue affects Master Slider Pro: from n/a through 3.6.5.

Explanation of Vulnerability in Simple Terms

02Summary

Master Slider Pro versions up to 3.6.5 contain a deserialization vulnerability that allows attackers to execute arbitrary code by crafting malicious serialized objects. An attacker can exploit this by tricking a site visitor into clicking a malicious link or visiting a compromised page. The vulnerability affects the slider's data handling and can compromise site integrity and confidentiality.

What an attacker can do

03Attacker Capabilities

Execute arbitrary code on the site by sending a malicious serialized object to an unsuspecting visitor.

Potential impact on your site

04Site Impact

An attacker can run code on your site, potentially stealing data, modifying content, or taking control of the installation.

Conditions required to exploit

05Prerequisites

The victim must click a malicious link or visit an attacker-controlled page while logged into or viewing the site.

Key dates

06Disclosure timeline

December 20, 2023 CVE published

April 28, 2026 Record updated

External resources

07References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2023-47507 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/502.html

Related vulnerabilities