CVE-2023-5952: 
WordPress vulnerability analysis and mitigation

The Welcart e-Commerce WordPress plugin before version 2.9.5 contains a vulnerability identified as CVE-2023-5952. The vulnerability allows unauthenticated users to perform PHP Object Injection by exploiting unserialized user input from cookies when a suitable gadget is present on the blog (WPScan).

The vulnerability is classified as an Object Injection vulnerability with a CVSS score of 9.8 (CRITICAL) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. It is mapped to CWE-502 and falls under the OWASP Top 10 category A8: Insecure Deserialization. The issue stems from the plugin's unsafe handling of cookie data, where user input is unserialized without proper validation (NVD, WPScan).

The vulnerability allows unauthenticated attackers to perform PHP Object Injection attacks, which could potentially lead to arbitrary code execution when a suitable gadget chain is present in the application. This represents a critical security risk as it requires no authentication and can result in complete system compromise (WPScan).

Users should immediately upgrade to Welcart e-Commerce version 2.9.5 or later, which contains the fix for this vulnerability (WPScan).