CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
What the vulnerability does
Improper Control of Generation of Code ('Code Injection') vulnerability in Jonathan Daggerhart Widget Wrangler widget-wrangler allows Code Injection.This issue affects Widget Wrangler: from n/a through <= 2.3.9.
Explanation of Vulnerability in Simple Terms
Widget Wrangler versions 2.3.9 and earlier contain a code injection vulnerability that allows high-privilege users to execute arbitrary PHP code on the site. An attacker with administrative or equivalent access can inject malicious code through the plugin, affecting confidentiality, integrity, and availability of the entire site. Update to a version newer than 2.3.9 immediately.
What an attacker can do
Run their own PHP code on the site with full system privileges.
Potential impact on your site
A compromised admin account can execute code affecting the entire site and any connected systems.
Conditions required to exploit
Attacker must have high-level administrative access to the site.
Key dates
External resources
Related vulnerabilities
