CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
What the vulnerability does
The WPCasa plugin for WordPress is vulnerable to Code Injection in all versions up to, and including, 1.4.1. This is due to insufficient input validation and restriction on the 'api_requests' function. This makes it possible for unauthenticated attackers to call arbitrary functions and execute code.
Explanation of Vulnerability in Simple Terms
WPCasa versions up to 1.4.1 contain a code injection vulnerability that allows unauthenticated attackers to run arbitrary PHP code on the site over the network. No user interaction is required. The vulnerability affects all three security properties: attackers can read sensitive data, modify site content, and disrupt availability. Update to version 1.5.2 or later immediately.
What an attacker can do
Run arbitrary PHP code on the site without authentication, reading data, modifying content, or taking the site offline.
Potential impact on your site
Complete compromise of the site: attackers can steal data, deface content, install malware, or shut down the site.
Conditions required to exploit
Network access only; no authentication or user interaction required.
Key dates
External resources
