What the vulnerability does
01Description
The CMB2 plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.10.1 via deserialization of untrusted input from the text_datetime_timestamp_timezone field. This makes it possible for authenticated attackers, with contributor access or higher, to inject a PHP Object. No POP chain is present in the vulnerable plugin. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code. Please note that the plugin is a developer toolkit. For the vulnerability to become exploitable, the presence of a metabox activation in your code (via functions.php for example) is required.
Explanation of Vulnerability in Simple Terms
02Summary
CMB2 versions up to 2.10.1 deserialize untrusted data without validation, allowing an authenticated attacker to execute arbitrary PHP code on the site. The vulnerability requires low-level authentication and high attack complexity but grants full control over site data and functionality. Update to version 2.12.0 or later to patch.
What an attacker can do
03Attacker Capabilities
Run arbitrary PHP code on the site, read/modify all data, and take full control of the WordPress installation.
Potential impact on your site
04Site Impact
Any authenticated user with low privileges can compromise the entire site, steal data, and inject malware.
Conditions required to exploit
05Prerequisites
Attacker must have low-level authenticated access (e.g., subscriber or contributor role) and craft a malicious serialized payload.
Key dates
06Disclosure timeline
April 9, 2024
CVE published
April 8, 2026
Record updated
