title: Customizer Export/Import < 0.9.6 - Admin+ PHP Object Injection
description: The Customizer Export/Import WordPress plugin before 0.9.6 unserializes user input provided via the settings, which could allow high privilege users such as admin to perform PHP Object Injection when a suitable gadget is present
problem types: CWE-502 Deserialization of Untrusted Data
affected:
{
vendor: Unknown
product: Customizer Export/Import
versions:
status: affected, versionType: custom, version: 0, lessThan: 0.9.6
defaultStatus: unaffected
collectionURL: https://wordpress.org/plugins
}