CVE-2023-2500

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

The Go Pricing - WordPress Responsive Pricing Tables plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 3.3.19 via deserialization of untrusted input from the 'go_pricing' shortcode 'data' parameter. This allows authenticated attackers, with subscriber-level permissions and above, to inject a PHP Object. No POP chain is present in the vulnerable plugin. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-502

Affected software

No affected versions have been published.

Timeline

Published: May 25, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-250004.7HashiCorp Vault's implementation of Shamir's secret sharing used precomputed table lookups, and was vulnerable to cache-timing attacks. An a CVE-2023-250017.8A maliciously crafted SKP file in Autodesk Navisworks 2023 and 2022 be used to trigger use-after-free vulnerability. Exploitation of this vu CVE-2023-250027.8A maliciously crafted SKP file in Autodesk products is used to trigger use-after-free vulnerability. Exploitation of this vulnerability may CVE-2023-250037.8A maliciously crafted pskernel.dll file in Autodesk AutoCAD 2023 and Maya 2022 may be used to trigger out-of-bound read write / read vulnera CVE-2023-250047.8A maliciously crafted pskernel.dll file in Autodesk products is used to trigger integer overflow vulnerabilities. Exploitation of these vuln CVE-2023-250057.8A maliciously crafted DLL file can be forced to read beyond allocated boundaries in Autodesk InfraWorks 2023, and 2021 when parsing the DLL CVE-2023-250067.8A malicious actor may convince a user to open a malicious USD file that may trigger a use-after-free vulnerability which could result in cod CVE-2023-250077.8A malicious actor may convince a user to open a malicious USD file that may trigger an uninitialized pointer which could result in code exec CVE-2023-250087.8A malicious actor may convince a user to open a malicious USD file that may trigger an out-of-bounds read vulnerability which could result i CVE-2023-250097.8A malicious actor may convince a user to open a malicious USD file that may trigger an out-of-bounds write vulnerability which could result CVE-2023-250107.8A malicious actor may convince a victim to open a malicious USD file that may trigger an uninitialized variable which may result in code exe CVE-2023-250117.8PC settings tool Ver10.1.26.0 and earlier, PC settings tool Ver11.0.22.0 and earlier allows a attacker to write to the registry as administr