CVE-2023-51470 CRITICAL

CVE-2023-51470: WordPress Rencontre – Dating Site Plugin <= 3.11.1 is vulnerable to PHP Object Injection

Vendor Jacques Malgrange
Product Rencontre – Dating Site
Weakness CWE-502 · Unsafe deserialization
Published December 29, 2023
Last update April 28, 2026
View on NVD All CVEs

CVSS base score

9.9/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

What the vulnerability does

01Description

Deserialization of Untrusted Data vulnerability in Jacques Malgrange Rencontre – Dating Site.This issue affects Rencontre – Dating Site: from n/a through 3.11.1.

Explanation of Vulnerability in Simple Terms

02Summary

Rencontre – Dating Site versions up to 3.11.1 contain a deserialization vulnerability that allows authenticated attackers to execute arbitrary code on the server. An attacker with a low-privilege account can craft malicious serialized data that, when processed by the application, runs their own PHP code with full site permissions. This affects confidentiality, integrity, and availability of the entire site.

What an attacker can do

03Attacker Capabilities

Run their own code on the server with full site permissions, compromising all data and functionality.

Potential impact on your site

04Site Impact

Complete compromise of the site: attackers can steal data, modify content, create admin accounts, or take the site offline.

Conditions required to exploit

05Prerequisites

Attacker must have a low-privilege user account on the site; no user interaction required.

Key dates

06Disclosure timeline

December 29, 2023 CVE published
April 28, 2026 Record updated

Related vulnerabilities

08Related CVE

CVE-2026-39474 WordPress Post Duplicator plugin <= 3.0.10 - PHP Object Injection vulnerability CVE-2026-57770 WordPress Grand Photography theme <= 5.7.8 - PHP Object Injection vulnerability CVE-2026-49763 WordPress Integration for Contact Form 7 HubSpot plugin <= 1.3.7 - PHP Object Injection vulnerability CVE-2026-49768 WordPress Happyforms plugin <= 1.26.13 - PHP Object Injection vulnerability CVE-2026-39555 WordPress Askka theme <= 1.3.1 - PHP Object Injection vulnerability