CVE-2023-52218 is a critical severity (10.0) PHP object injection in the WooCommerce Tranzila Payment Gateway WordPress plugin, affecting version 1.0.8 and earlier. Patchstack lists no official patch. Remove the plugin or replace it with a maintained alternative, and deactivate it in the meantime.
What's affected
The NVD record names Anton Bond and the WooCommerce Tranzila Payment Gateway plugin for WordPress, from the earliest release through 1.0.8. Patchstack shows no official patch for this plugin. I could not confirm a fixed version, so check the plugin page and developer for a release newer than 1.0.8.
The weakness is CWE-502, deserialization of untrusted data. The record's CVSS vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H, which gives 10.0 (Critical).
Patchstack lists the required privilege as unauthenticated. No login is needed. This is the maximum CVSS score of 10.0, and Patchstack rates it high priority. Patchstack also says it has a mitigation rule for its own customers, which is not a fix in the plugin.
How to check if you're exposed
Start with the plugin list. On a server with WP-CLI, run this from the site folder:
wp plugin list
wp plugin get woo-tranzila-gateway
The first command shows every installed plugin with its version and status. The second shows the details of this one. If the slug is not found, the plugin is not installed under that folder name.
Without shell access, open Plugins, Installed Plugins in the admin and read the version under the plugin name. On WordPress multisite, check the network plugin list and each site, since a plugin can be active on only some of them.
A version at or below 1.0.8 is in the affected range. An inactive plugin is lower risk than an active one, but it is still on disk, so remove it if it is unused.
What to do now
- Open the Plugins screen, or run the WP-CLI check above, and note the installed version.
- Deactivate WooCommerce Tranzila Payment Gateway, then delete it if you can live without it.
- If you need the function, look for a maintained plugin that does the same job, and test it before switching.
- Review recent activity: check web server logs for odd requests to the gateway, new administrator accounts, and unfamiliar PHP files in the uploads or plugin folders.
- If you must keep it for now, restrict access with your host or a web application firewall rule and set a date to remove it.
Why it matters
Deserialization of untrusted data means the plugin rebuilds a PHP object from a string supplied by the requester. In PHP, rebuilding an object can trigger code in the application or in other installed libraries. Patchstack calls this PHP object injection and describes the result as attackers being able to make the site run harmful actions on the server.
The danger often depends on which other classes are loaded on the site, so the real impact varies between installations. The score is high because the worst case is full control of the server side code, and because several of these plugins accept the data without a login. A payment gateway plugin sits close to order and customer data, so a compromise has a wider blast radius than most plugins. This CVE is not listed in the CISA Known Exploited Vulnerabilities catalog, and the sources I read do not report exploitation in the wild. Safeguard's free in-browser dependency scan at gold.safeguard.sh/scan and the Gold directory help you track which components you run and which advisories apply.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is CVE-2023-52218 being exploited?
It is not in the CISA Known Exploited Vulnerabilities catalog, and the sources I read do not report exploitation. Patchstack says vulnerabilities of this kind are expected to be exploited in mass campaigns, which is a risk assessment rather than an observation.
Is there a patched version?
Not according to Patchstack, which shows no official patch at the time of writing. Check the developer's plugin page for anything newer than 1.0.8 before you decide.
Sources
Last reviewed: 19 October 2026.
