CVE-2023-6049 is a critical (CVSS 9.8 in the record) PHP object injection flaw in the Estatik Real Estate Plugin for WordPress, before 4.1.1. The plugin unserializes user input from some cookies. Update to 4.1.1 or later. WPScan scores it 8.1 High and notes that impact depends on a suitable gadget chain.
What's affected
- Plugin: Estatik Real Estate Plugin for WordPress.
- Affected: versions before 4.1.1.
- Fixed: 4.1.1, per the NVD record and WPScan.
- Severity: 9.8 Critical in the NVD record. WPScan scores it 8.1 High. The difference reflects the gadget chain condition.
- Condition: harm depends on another installed plugin or theme providing a usable gadget chain.
How to check if you're exposed
In the WordPress admin, open Plugins and read the version shown under Estatik Real Estate Plugin. With shell access and WP-CLI, this lists every installed plugin with its version, status and whether an update is waiting:
wp plugin list --fields=name,title,version,status,update
Find the row for Estatik Real Estate Plugin and compare its version with the fixed version above. On a multisite network, run the same command on each site, because a plugin can be active on some sites and not others. The folder is estatik.
A version below 4.1.1 is affected. The risk is higher on sites with many plugins and themes, because each one adds code that could serve as a gadget. Reducing installed code reduces that risk.
What to do now
- Update Estatik to 4.1.1 or later.
- Remove plugins and themes you do not use. Inactive code on disk can still supply gadgets for deserialization attacks.
- Keep all other plugins current, since the severity of object injection depends on what else is installed.
- Add web application firewall rules that block serialized object patterns in cookies, as a stopgap.
- Check for unexpected files, administrator users and scheduled tasks if the site was exposed for a long time.
Why it matters
The plugin takes data from a cookie and passes it to PHP's unserialize function. The record lists CWE-502, deserialization of untrusted data. PHP restores objects of whatever class the data names, and some classes run code automatically when restored or destroyed. If any loaded class has useful behavior, an attacker can chain it into actions such as file writes or deletions. Security people call that a gadget chain.
That is why the two scores differ. The bug alone does nothing without a gadget, but an unauthenticated entry point plus a rich plugin ecosystem often provides one. The attacker needs only to send a request. The safe pattern is to avoid unserialize on user input and use JSON instead. The record does not list this CVE as known exploited. Check whether exploitation conditions truly apply to your site, as the demo below shows.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
If I have no known gadget, am I safe?
Not reliably. New plugins, theme updates and future vulnerabilities can add one. Update the plugin and keep installed code to a minimum.
Sources
Last reviewed: 19 October 2026.
