What the vulnerability does
01Description
The Shortcodes and extra features for Phlox theme plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.17.5 via deserialization of untrusted input from the vulnerable 'id' parameter in the 'auxin_template_control_importer' function. This makes it possible for authenticated attackers able to upload a separate PHAR payload as an image file to inject a PHP Object, though the action itself is available to subscribers. No POP chain is present in the vulnerable plugin. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.
Explanation of Vulnerability in Simple Terms
02Summary
The Shortcodes and extra features for Phlox theme contains a deserialization vulnerability in versions up to 2.17.5. An authenticated attacker with low privileges can send a specially crafted request to deserialize untrusted data, potentially executing arbitrary code on the site. This requires network access and high attack complexity but grants full control over site data and functionality.
What an attacker can do
03Attacker Capabilities
Execute arbitrary code on the site and read or modify any data.
Potential impact on your site
04Site Impact
A logged-in user with basic permissions could compromise your entire site, including database access and file modification.
Conditions required to exploit
05Prerequisites
Attacker must be logged in with low-level user privileges; no user interaction required.
Key dates
06Disclosure timeline
May 2, 2024
CVE published
April 8, 2026
Record updated
