CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
What the vulnerability does
The Easy Timer plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.2.1 via the plugin's shortcodes. This is due to insufficient restriction of shortcode attributes. This makes it possible for authenticated attackers, with Editor-level access and above, to execute code on the server.
Explanation of Vulnerability in Simple Terms
Easy Timer versions 4.2.1 and earlier contain a code injection vulnerability that allows high-privileged users to execute arbitrary code on the site. An attacker with administrative or equivalent access can inject malicious code through the application, leading to full compromise of confidentiality, integrity, and availability. Update to a version newer than 4.2.1 immediately.
What an attacker can do
Run arbitrary code on the site with full system access.
Potential impact on your site
A compromised admin account can execute code, steal data, modify content, or disable the site entirely.
Conditions required to exploit
Attacker must have high-level administrative privileges on the Easy Timer application.
Key dates
External resources
