CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L
What the vulnerability does
The Head, Footer and Post Injections plugin for WordPress is vulnerable to PHP Code Injection in all versions up to, and including, 3.3.0. This makes it possible for authenticated attackers, with Administrator-level access and above, to inject PHP Code in multisite environments.
Explanation of Vulnerability in Simple Terms
Head, Footer and Post Injections through version 3.3.0 contains a code injection vulnerability in how it processes injected content. An authenticated administrator with high privileges can inject malicious code that executes within the site. The vulnerability requires deliberate action by a high-privilege user and has limited impact on confidentiality, integrity, and availability.
What an attacker can do
Inject and execute arbitrary code on the site if they have administrator-level access.
Potential impact on your site
A malicious or compromised admin account can inject code affecting site content, data, or functionality.
Conditions required to exploit
Attacker must have high-privilege administrator credentials and network access to the site.
Key dates
External resources
Related vulnerabilities
