CVE-2023-6049: Estatik

Critical severity, CVSS 9.8. EPSS: 0.9% chance of exploitation in the next 30 days.

The Estatik Real Estate Plugin WordPress plugin before 4.1.1 unserializes user input via some of its cookies, which could allow unauthenticated users to perform PHP Object Injection when a suitable gadget chain is present on the blog

Affected products

• Estatik Estatik: before 4.1.1 (fixed in 4.1.1)

Published 2024-01-15. Last modified 2026-06-17.