CVE-2023-4994 CRITICAL

CVE-2023-4994: Allow PHP in Posts and Pages <= 3.0.4 - Authenticated (Subscriber+) Remote Code Execution via Shortcode

Vendor Hit-Reach

Product Allow PHP in Posts and Pages

Weakness CWE-94 · Code injection

Published September 16, 2023

Last update April 8, 2026

View on NVD All CVEs

CVSS base score

9.9/10

Attack vector Network

Attack complexity Low

Privileges required Low

User interaction None

Confidentiality High

Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

What the vulnerability does

01Description

The Allow PHP in Posts and Pages plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 3.0.4 via the 'php' shortcode. This allows authenticated attackers with subscriber-level permissions or above, to execute code on the server.

Key dates

02Disclosure timeline

September 16, 2023 CVE published

April 8, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2023-4994 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/94.html

Related vulnerabilities

04Related CVE

CVE-2026-45132 CloudPirates Open Source Helm Charts: GitHub Actions workflow leaks PAT and SSH signing key via unsafe credential handling CVE-2026-42785 OpenKM 6.3.12 Remote Code Execution via Administrative Scripting CVE-2025-54063 Cherry Studio One-click Remote Code Execution Vulnerability through Custom URL Handling CVE-2025-14927 Hugging Face Transformers SEW-D convert_config Code Injection Remote Code Execution Vulnerability CVE-2023-22677 WordPress WP Booklet Plugin <= 2.1.8 is vulnerable to Remote Code Execution (RCE)