CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
What the vulnerability does
The W3SPEEDSTER plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 7.26 via the 'script' parameter of the hookBeforeStartOptimization() function. This is due to the plugin passing user supplied input to eval(). This makes it possible for authenticated attackers, with Administrator-level access and above, to execute code on the server.
Explanation of Vulnerability in Simple Terms
W3SPEEDSTER versions 7.26 and earlier contain an improper code evaluation vulnerability that allows high-privileged users to execute arbitrary code on the site. The vulnerability stems from unsafe handling of user-supplied input in code evaluation contexts. An attacker with administrative access can inject malicious code that executes with full site privileges, potentially compromising the entire installation.
What an attacker can do
Run arbitrary code on the site with full administrative privileges.
Potential impact on your site
A compromised admin account can execute any code, steal data, modify content, or take the site offline.
Conditions required to exploit
Attacker must have high-level administrative access to the site.
Key dates
External resources
Related vulnerabilities
