Paper/Archive/CVE-2023-4994

CVE-2023-4994

hit-reach Allow PHP in Posts and Pages — Allow PHP in Posts and Pages <= 3.0.4 - Authenticated (Subscriber+) Remote Code Execution via Shortcode

EPSS 0.9%CVSS 9.9

critical.is priorityof 100

CVSS 9.9 (CNA)9.9 / 10 × 3029.7 Not in CISA KEV+300.0 EPSS percentile 59.4.594 × 2011.9 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

The Allow PHP in Posts and Pages plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 3.0.4 via the 'php' shortcode. This allows authenticated attackers with subscriber-level permissions or above, to execute code on the server.

Affected

ProductAffectedFixed inSource

Allow PHP in Posts and Pages≤ 3.0.4–CNA

Scores by source

Wordfence (CNA)9.9CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refwordfence.com/threat-intel/vulnerabilities/id/3d8b4bb6-3715-40c1-8140-7fcf874ccec3?source=cve refplugins.trac.wordpress.org/browser/allow-php-in-posts-and-pages/trunk/allowphp.php#L373