by Kastro
Paper/Archive/CVE-2024-6330

CVE-2024-6330

Unknown GEO my WP — GEO my WordPress < 4.4.0.2 - Unauthenticated RCE via LFI

EPSS 2%CVSS 9.8
critical.is priorityof 100
46
CVSS 9.8 (ADP)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 82.1.821 × 2016.4No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

The GEO my WP WordPress plugin before 4.5.0.2 does not prevent unauthenticated attackers from including arbitrary files in PHP's execution context, which leads to Remote Code Execution.

Affected

ProductAffectedFixed inSource
GEO my WP< 4.5.0.24.5.0.2CNA
geo_my_wp< 4.5.0.24.5.0.2CISA-ADP

Scores by source

CISA ADP9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

exploitwpscan.com/vulnerability/95b532e0-1ffb-421e-b9c0-de03f89491d7