CVE-2023-49819 HIGH

CVE-2023-49819: WordPress Structured Content Plugin <= 1.5.3 is vulnerable to PHP Object Injection

Vendor Gordon Böhme, Antonio Leutsch
Product Structured Content (JSON-LD) #wpsc
Weakness CWE-502 · Unsafe deserialization
Published December 18, 2023
Last update April 28, 2026
View on NVD All CVEs

CVSS base score

7.5/10
Attack vector Network
Attack complexity High
Privileges required Low
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

Deserialization of Untrusted Data vulnerability in Gordon Böhme, Antonio Leutsch Structured Content (JSON-LD) #wpsc.This issue affects Structured Content (JSON-LD) #wpsc: from n/a through 1.5.3.

Explanation of Vulnerability in Simple Terms

02Summary

The Structured Content (JSON-LD) #wpsc plugin for WordPress contains a deserialization vulnerability in versions up to 1.5.3. An authenticated attacker with low privileges can send a specially crafted request to deserialize untrusted data, potentially leading to remote code execution. The attack requires network access and high attack complexity but does not require user interaction.

What an attacker can do

03Attacker Capabilities

Run arbitrary code on the site with the privileges of the WordPress user account.

Potential impact on your site

04Site Impact

An attacker with a basic WordPress account can compromise your entire site, steal data, or modify content.

Conditions required to exploit

05Prerequisites

Attacker must have a low-privilege WordPress account (e.g., subscriber or contributor role).

Key dates

06Disclosure timeline

December 18, 2023 CVE published
April 28, 2026 Record updated

Related vulnerabilities

08Related CVE

CVE-2026-39551 WordPress Töbel theme <= 1.8.1 - PHP Object Injection vulnerability CVE-2026-49765 WordPress Integration for Mailchimp and Contact Form 7, WPForms, Elementor, Ninja Forms plugin <= 1.1.8 - PHP Object Injection vulnerability CVE-2026-7566 LearnPress – Backup & Migration Tool <= 4.1.4 - Authenticated (Administrator+) PHP Object Injection via WXR XML File Upload CVE-2026-57724 WordPress Kirki plugin <= 6.0.12 - PHP Object Injection vulnerability CVE-2026-27414 WordPress Werkstatt theme <= 4.8.3 - PHP Object Injection vulnerability