title: Customizer Export/Import < 0.9.5 - Admin+ PHP Objection Injection
description: The Customizer Export/Import WordPress plugin before 0.9.5 unserializes the content of an imported file, which could lead to PHP object injection issues when an admin imports (intentionally or not) a malicious file and a suitable gadget chain is present on the blog.
problem types: CWE-502 Deserialization of Untrusted Data
affected:
{
vendor: Unknown
product: Customizer Export/Import
versions:
version: 0.9.5, status: affected, lessThan: 0.9.5, versionType: custom
}