CVE-2024-24707 CRITICAL

CVE-2024-24707: WordPress Cwicly plugin <= 1.4.0.2 - Auth. Remote Code Execution (RCE) vulnerability

Vendor Cwicly Builder, Sl.

Product Cwicly

Weakness CWE-94 · Code injection

Published April 3, 2024

Last update April 28, 2026

View on NVD All CVEs

CVSS base score

9.9/10

Attack vector Network

Attack complexity Low

Privileges required Low

User interaction None

Confidentiality High

Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

What the vulnerability does

01Description

Improper Control of Generation of Code ('Code Injection') vulnerability in Cwicly Builder, SL. Cwicly allows Code Injection.This issue affects Cwicly: from n/a through 1.4.0.2.

Explanation of Vulnerability in Simple Terms

02Summary

Cwicly versions up to 1.4.0.2 allow authenticated users with low privileges to inject and execute arbitrary code on the site. The vulnerability stems from insufficient input validation in code processing. An attacker with a low-privilege account can run their own PHP code, potentially compromising the entire site including data and functionality.

What an attacker can do

03Attacker Capabilities

Run arbitrary code on the site with full access to the database and file system.

Potential impact on your site

04Site Impact

Complete site compromise: data theft, malware injection, defacement, or total loss of control.

Conditions required to exploit

05Prerequisites

Attacker must have a low-privilege user account (e.g., contributor or subscriber role).

Key dates

06Disclosure timeline

April 3, 2024 CVE published

April 28, 2026 Record updated

External resources

07References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2024-24707 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/94.html AskarLabs — CWE-94 write-up Code Injection

Related vulnerabilities