CVE-2023-1347

The Customizer Export/Import plugin through version 0.9.5 contains a PHP Object Injection vulnerability stemming from unsafe deserialization of data imported from files. Attackers with administrator privileges can inject malicious PHP objects during the import process. While the plugin itself lacks a gadget chain for exploitation, the presence of one in other installed plugins or themes could enable attackers to execute arbitrary code, extract confidential information, or remove files from the system.

Based on public CVE data (MITRE/NVD).