CVE-2023-1669

The SEOPress plugin for WordPress versions prior to 6.5.0.3 contains a PHP Object Injection vulnerability in the seopress_import_rk_redirections function, where the $redirect_value['sources'] parameter undergoes unsafe deserialization of untrusted data. This flaw can be exploited by authenticated users with administrator privileges to inject arbitrary PHP objects. While the plugin itself lacks a gadget chain for direct exploitation, the presence of one in another installed plugin or theme could enable attackers to perform actions such as arbitrary file deletion, sensitive information disclosure, or remote code execution.

Based on public CVE data (MITRE/NVD).