CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
What the vulnerability does
The Allow PHP in Posts and Pages plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 3.0.4 via the 'php' shortcode. This allows authenticated attackers with subscriber-level permissions or above, to execute code on the server.
Explanation of Vulnerability in Simple Terms
The Allow PHP in Posts and Pages plugin for WordPress contains a code injection vulnerability that allows authenticated users with low privileges to execute arbitrary PHP code on the site. An attacker with a basic user account can inject and run malicious code, potentially compromising the entire WordPress installation. The vulnerability affects all versions up to and including 3.0.4.
What an attacker can do
Run arbitrary PHP code on the site with the privileges of the web server.
Potential impact on your site
Complete site compromise: attackers can steal data, modify content, create backdoors, or take the site offline.
Conditions required to exploit
Attacker must have a low-privilege WordPress user account (e.g., Contributor or Author role).
Key dates
External resources
Related vulnerabilities
