CVE-2023-28667

CRITICAL 9.8CVE-2023-28667 · Published 22/03/2023 · updated 17/06/2026

In short

CVE-2023-28667 is a CRITICAL (CVSS 9.8) vulnerability affecting lead generated (leadgenerated).
Chance of exploitation in the next 30 days (EPSS): 1.1%, higher than 66.0% of all vulnerabilities.
Fix: update to 1.25 or later.

Package	Affected versions	Patched versions
lead generated leadgenerated	`< 1.25`	`1.25`

Description

The Lead Generated WordPress Plugin, version <= 1.23, was affected by an unauthenticated insecure deserialization issue. The tve_labels parameter of the tve_api_form_submit action is passed to the PHP unserialize() function without being sanitized or verified, and as a result could lead to PHP object injection, which when combined with certain class implementations / gadget chains could be leveraged to perform a variety of malicious actions granted a POP chain is also present.

References

tenable.com/security/research/tra-2023-7 · Exploit

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free