CVE-2023-51414: 
WordPress vulnerability analysis and mitigation

A Deserialization of Untrusted Data vulnerability (CVE-2023-51414) was discovered in EnvialoSimple EnvíaloSimple: Email Marketing y Newsletters WordPress plugin versions up to and including 2.1. The vulnerability was disclosed on December 27, 2023, and received a CVSS v3.1 base score of 9.8 (Critical) from NIST and 9.6 (Critical) from Patchstack (NVD, Patchstack).

The vulnerability is classified as a PHP Object Injection vulnerability (CWE-502). It allows unauthenticated attackers to perform deserialization of untrusted data. The vulnerability can be exploited remotely and requires no special privileges or user interaction to execute (Patchstack).

The vulnerability could potentially allow attackers to execute code injection, SQL injection, path traversal, or denial of service attacks if a proper POP chain is present. Given its critical severity rating and unauthenticated nature, the impact of successful exploitation could be severe (Patchstack).

Users are advised to update to version 2.2 or later of the EnvíaloSimple plugin to resolve the vulnerability. Patchstack has issued a virtual patch to mitigate this issue by blocking attacks until users can update to a fixed version (Patchstack).