A crafted payload can be written to the user_prefs database column and later executed when the preference data is loaded because the unserialization function passes the data to eval(). The vulnerability allows an attacker with the ability to write to the database to run arbitrary PHP code in the context of the e107 web application. The weakness is classified as an unsafe unserialization leading to remote code execution.

The vulnerability exists in the e107 content management system prior to version 2.3.8. Users of older e107 installations running the default e_array::unserialize() handler are susceptible.

The vulnerability is assessed with a CVSS score of 7.7. The EPSS score is less than 1 % and the issue is not listed in CISA's KEV catalog, indicating no known widespread exploitation at this time. The attack requires the attacker to have out‑of‑band write access to the database to inject a malicious payload into the user_prefs column. Once injected, the payload is executed automatically when e_user_pref::load() calls the unserialization routine, giving the attacker full code execution capabilities on the server.