CVE-2023-53872 CRITICAL

CVE-2023-53872: Wp2Fac 1.0 OS Command Injection via send.php Endpoint

Vendor Wp2Fac
Product Wp2Fac
Weakness CWE-78
Published December 15, 2025
Last update April 7, 2026
View on NVD All CVEs

CVSS base score

9.3/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

What the vulnerability does

01Description

Wp2Fac 1.0 contains an OS command injection vulnerability in the send.php endpoint that allows remote attackers to execute arbitrary system commands. Attackers can inject shell commands through the 'numara' parameter by appending shell commands with '&' operators to execute malicious code.

Key dates

02Disclosure timeline

December 15, 2025 CVE published
April 7, 2026 Record updated