CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
What the vulnerability does
Improper Control of Generation of Code ('Code Injection') vulnerability in wpspin Post/Page Copying Tool postpage-import-export-with-custom-fields-taxonomies allows Remote Code Inclusion.This issue affects Post/Page Copying Tool: from n/a through <= 2.0.3.
Explanation of Vulnerability in Simple Terms
The Post/Page Copying Tool for WordPress contains a code injection vulnerability that allows authenticated users with low privileges to inject and execute arbitrary PHP code on the site. The vulnerability affects all versions up to 2.0.3. An attacker with a basic user account can exploit this without user interaction, potentially compromising the entire WordPress installation and any connected systems.
What an attacker can do
Run arbitrary PHP code on the site with full access to the database and file system.
Potential impact on your site
Complete site compromise: attacker can steal data, modify content, create admin accounts, or pivot to other systems.
Conditions required to exploit
Attacker needs a low-privilege WordPress user account (e.g., Contributor or Author role).
Key dates
External resources
Related vulnerabilities
