Is CVE-2023-51700 actively exploited?

No active exploitation of CVE-2023-51700 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2023-51700 be exploited remotely?

Yes. CVE-2023-51700 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2023-51700?

CVE-2023-51700 has a CVSS score of 9.8 (CRITICAL).

HOME VULNERABILITIESCVE-2023-51700

CRITICAL

CVE-2023-51700

CWE-502Published: December 27, 2023· Updated: Jun 17, 2026

9.8

CVSS v3.1

Official Description

Unofficial Mobile BankID Integration for WordPress lets users employ Mobile BankID to authenticate themselves on your WordPress site. Prior to 1.0.1, WP-Mobile-BankID-Integration is affected by a vulnerability classified as a Deserialization of Untrusted Data vulnerability, specifically impacting scenarios where an attacker can manipulate the database. If unauthorized actors gain access to the database, they could exploit this vulnerability to execute object injection attacks. This could lead to unauthorized code execution, data manipulation, or data exfiltration within the WordPress environment. Users of the plugin should upgrade to version 1.0.1 (or later), where the serialization and deserialization of OrderResponse objects have been switched out to an array stored as JSON. A possible workaround for users unable to upgrade immediately is to enforce stricter access controls on the database, ensuring that only trusted and authorized entities can modify data. Additionally, implementing monitoring tools to detect unusual database activities could help identify and mitigate potential exploitation attempts.

NVD Source

Risk Analysis

The Unofficial Mobile BankID Integration plugin for WordPress is vulnerable to object injection due to insecure deserialization of untrusted data. This critical flaw allows for code execution and data exfiltration, rated 9.8 on the CVSS scale.

No public exploit is known for this vulnerability, and it is not in the CISA KEV catalog. It is remotely exploitable.

Recommended Action

Users should upgrade the plugin to version 1.0.1 or later, which replaces the vulnerable serialization method.

Generated by the CTIWATCH analysis pipeline from this CVE's metadata (CVSS, EPSS, KEV status, exploit intelligence). Verify against vendor advisories before acting.

Technical Analysis

CVE-2023-51700 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.

A successful exploit results in complete confidentiality breach (data exposure), full integrity compromise (data manipulation), availability disruption (denial of service), with a CVSS base score of 9.8.

From a weakness classification perspective (CWE-502): Insecure deserialization vulnerabilities allow attackers to inject malicious objects during deserialization, potentially enabling remote code execution.