CVE-2023-6933 Exploit Metadata

PoC files

6 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

Analysisdeepseek-v4-pro:cloud · 2026-08-12

Technical assessment

The artifact is a Nuclei template and supporting documentation that detects the presence of the vulnerable Better Search Replace plugin (CVE-2023-6933) and verifies the PHP object injection vulnerability by sending a safe serialized payload and analyzing the HTTP response. It does not execute arbitrary code or exploit the vulnerability for impact.

Backdoor review

No backdoor observed in reviewed code

The supplied evidence consists of documentation and a Nuclei template for CVE-2023-6933. The template sends a harmless stdClass serialized object with dry_run=1 to a known vulnerable endpoint. No concealed executable behavior, persistence, credential theft, or unrelated payload is present. The artifact demonstrates the claimed PHP Object Injection vulnerability without backdoor or deceptive harm.

ClassificationScanner

Model confidence95%

AuthenticationNot required

LanguagesYAMLMarkdown

Target softwareBetter Search Replace WordPress Plugin

Attack typesPHP Object InjectionDeserialization of Untrusted Data

Evidence & reasoningClassification basis · observed behavior · safety review

Technical evidence

Classification basis and observed behavior

Classification basis

The primary artifact is a Nuclei template (cve-2023-6933.yaml) that sends HTTP requests to detect the plugin and verify the deserialization vulnerability by analyzing responses. It uses a safe stdClass payload and dry_run=1 to avoid exploitation. The documentation explicitly states it is a 'non-intrusive' 'Proof-of-Concept' for 'verification' and 'detection', not for achieving code execution or data impact. This matches the definition of a scanner.

CVE-2023-6933_POC_DOCUMENTATION.md:80-82CVE-2023-6933_POC_DOCUMENTATION.md:97-102nuclei-templates/cve-2023-6933.yaml:1-115

Requirements

Target must have Better Search Replace plugin version <= 1.4.4 installed.nuclei-templates/cve-2023-6933.yaml:53
The WordPress admin-ajax.php endpoint must be accessible.nuclei-templates/cve-2023-6933.yaml:72

Observed behavior

Sends a GET request to the plugin's README.txt to detect the plugin and extract its version.nuclei-templates/cve-2023-6933.yaml:38-40
Sends a POST request to admin-ajax.php with a serialized stdClass object in the search_for parameter and dry_run=1 to trigger the vulnerable unserialize call without modifying the database.nuclei-templates/cve-2023-6933.yaml:70-80
Matches HTTP response status codes 400, 403, or 500, a body containing '0', and non-empty body with specific content types to confirm the vulnerability.nuclei-templates/cve-2023-6933.yaml:84-101

Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Serialized Payload: O:8:"stdClass":2:{s:6:"marker";s:{{len(marker)}}:"{{marker}}";s:4:"test";i:1337;}The Nuclei template sends a harmless stdClass object with dry_run=1 to demonstrate deserialization without destructive effects.nuclei-templates/cve-2023-6933.yaml:35nuclei-templates/cve-2023-6933.yaml:80
Safety Parameter: dry_run=1The POST body includes dry_run=1, which prevents database modifications during testing.nuclei-templates/cve-2023-6933.yaml:80

Review boundaries

What the analysis did not establish

The evidence includes only the Nuclei template and documentation; the referenced PHP exploit scripts (cve_2023_6933_exploit.php, wp_html_token_poc.php, bsr_direct_exploit.php) and manual-test.sh are not provided in the selected text, so their content cannot be analyzed.
The analysis is based solely on the supplied text files; no code was executed, and the actual behavior of the template against a live target is not verified.
Three files (binary or non-text) were flagged as metadata-only and not analyzed; their content could not be reviewed.
The review is limited to the supplied text evidence; no runtime behavior was observed.

Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Docker lab environments

GitHub

docker-compose.yml

Created 2025-09-22Vuln labCVE-2023-6933Compose · images

1 Compose manifest · 3 services

Analysisdeepseek-v4-pro:cloud · 2026-08-07

Environment assessment

A Docker Compose environment deploying a WordPress 6.4.0 instance with the vulnerable Better Search Replace plugin (≤1.4.4), a MySQL 8.0 database, and phpMyAdmin for database management. The environment is designed to demonstrate CVE-2023-6933, a PHP Object Injection vulnerability.

docker-compose.yml:1-52readme.md:1-6

Lab assessment

Vulnerability lab

The README explicitly states the environment demonstrates CVE-2023-6933, a critical PHP Object Injection vulnerability in the Better Search Replace WordPress plugin. The Docker Compose file deploys a custom WordPress image ('trex999/vulnerable-bsr-lab:latest') that includes the vulnerable plugin, along with supporting services, forming a complete reproduction environment for the vulnerability.

readme.md:1-6docker-compose.yml:1-52

Lab shapeCompose · images

Services3

Compose manifests1

Dockerfiles0

Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries

Components

Services and files described by the evidence

wordpress

vulnerable targetweb application

A WordPress 6.4.0 container based on the custom image 'trex999/vulnerable-bsr-lab:latest'. It includes the vulnerable Better Search Replace plugin (version ≤1.4.4) and exposes port 8080 on the host. It connects to the MySQL service for database storage.

docker-compose.yml:2-15readme.md:1-6

mysql

database server

A MySQL 8.0 database server that stores WordPress data. It uses a named volume 'mysql_data' for persistence and is connected to the 'lab_network' bridge network.

docker-compose.yml:17-28

phpmyadmin

database management tool

A phpMyAdmin 5.2 instance for managing the MySQL database. It exposes port 8081 on the host and depends on the MySQL service.

docker-compose.yml:30-41

manual-test.sh

manual testing script

A bash script that performs a series of checks and tests against the lab environment to verify the presence and exploitability of CVE-2023-6933. It sends crafted HTTP requests to the WordPress admin-ajax.php endpoint with serialized PHP objects and checks for vulnerability indicators.

manual-test.sh:1-245

CVE-2023-6933_POC_DOCUMENTATION.md

technical documentation

A document providing detailed technical analysis of the CVE-2023-6933 vulnerability, including root cause, vulnerable code path, and a description of the proof-of-concept methodology using Nuclei templates.

CVE-2023-6933_POC_DOCUMENTATION.md:1-199

CVE assessment

How the supplied evidence relates each vulnerability

CVE-2023-6933

Supported by supplied evidence

The lab environment is explicitly built to demonstrate CVE-2023-6933. The README, documentation, and testing script all reference this CVE, describe the vulnerable plugin (Better Search Replace ≤1.4.4), and provide methods to trigger the PHP Object Injection via the admin-ajax.php endpoint. The Docker Compose file uses a custom image that includes the vulnerable plugin.

readme.md:1-6CVE-2023-6933_POC_DOCUMENTATION.md:1-10manual-test.sh:1-4

Exercise context

Requirements and sequence described by the evidence

Prerequisites

Docker and Docker Compose must be installed to deploy the lab environment.readme.md:13-17
The lab must be deployed using 'docker-compose up -d' and the services must be fully started (approximately 60 seconds).readme.md:13-22
For automated testing, Nuclei v3.0+ must be installed.CVE-2023-6933_POC_DOCUMENTATION.md:120-122

Evidence-described exercise path

Deploy the lab environment using 'docker-compose up -d'.readme.md:13-17
Access the WordPress instance at http://localhost:8080 and verify the vulnerable plugin is active.readme.md:24-26
Run the automated Nuclei template to detect the vulnerability: 'nuclei -t nuclei-templates/cve-2023-6933.yaml -target http://localhost:8080 -v'.readme.md:29-31
Alternatively, perform manual testing by sending a crafted POST request to /wp-admin/admin-ajax.php with a serialized PHP object in the 'search_for' parameter and action 'search_replace_db'.readme.md:33-36
Observe the response for indicators of successful deserialization, such as a '0' response or behavioral changes, confirming the vulnerability.CVE-2023-6933_POC_DOCUMENTATION.md:100-110

Safety-review evidence

Behaviors behind the stored safety assessment

No harmful behavior observed

The lab is a self-contained Docker Compose environment designed for vulnerability research. All exploit attempts target the lab's own WordPress container via localhost. The testing scripts and documentation emphasize non-destructive, read-only testing (e.g., using 'dry_run=1' and safe stdClass objects). No behavior is observed that escapes the container boundary, targets the host, or reaches external systems. Port mappings (8080, 8081) and a named volume are standard for a local lab and do not indicate malicious intent.

docker-compose.yml:1-52CVE-2023-6933_POC_DOCUMENTATION.md:60-80manual-test.sh:1-245

Review boundaries

What the analysis did not establish

The custom WordPress image 'trex999/vulnerable-bsr-lab:latest' is a pre-built binary that was not inspected. Its internal behavior beyond the documented vulnerability cannot be verified from the supplied evidence.
The Nuclei template file 'nuclei-templates/cve-2023-6933.yaml' is present in the file inventory but its full content was not included in the evidence packet, so its exact behavior cannot be analyzed.
The manual-test.sh script includes a payload that attempts to write a file to /tmp/bsr_test.txt inside the WordPress container, which is a destructive action, but it is part of the documented RCE demonstration and is contained within the lab.

Model interpretation

This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.

Linked vulnerabilities

CVE-2023-6933