CVE-2023-4994

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-4994
The Allow PHP in Posts and Pages plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 3.0.4 via the 'php' shortcode. This allows authenticated attackers with subscriber-level permissions or above, to execute code on the server.

9.9 /10

CVSS v3 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.1 / Impact : 6.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References
Link Resource
https://plugins.trac.wordpress.org/browser/allow-php-in-posts-and-pages/trunk/allowphp.php#L373 Patch
https://www.wordfence.com/threat-intel/vulnerabilities/id/3d8b4bb6-3715-40c1-8140-7fcf874ccec3?source=cve Third Party Advisory
https://plugins.trac.wordpress.org/browser/allow-php-in-posts-and-pages/trunk/allowphp.php#L373 Patch
https://www.wordfence.com/threat-intel/vulnerabilities/id/3d8b4bb6-3715-40c1-8140-7fcf874ccec3?source=cve Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:hitreach:allow_php_in_posts_and_pages:*:*:*:*:*:wordpress:*:*
History

21 Nov 2024, 08:36

Type Values Removed Values Added
CVSS v2 : unknown
v3 : 6.4 		v2 : unknown
v3 : 9.9
References () https://plugins.trac.wordpress.org/browser/allow-php-in-posts-and-pages/trunk/allowphp.php#L373 - Patch () https://plugins.trac.wordpress.org/browser/allow-php-in-posts-and-pages/trunk/allowphp.php#L373 - Patch
References () https://www.wordfence.com/threat-intel/vulnerabilities/id/3d8b4bb6-3715-40c1-8140-7fcf874ccec3?source=cve - Third Party Advisory () https://www.wordfence.com/threat-intel/vulnerabilities/id/3d8b4bb6-3715-40c1-8140-7fcf874ccec3?source=cve - Third Party Advisory

07 Nov 2023, 04:23

Type Values Removed Values Added
CWE CWE-94

20 Sep 2023, 13:21

Type Values Removed Values Added
First Time Hitreach allow Php In Posts And Pages
Hitreach
CVSS v2 : unknown
v3 : 9.9 		v2 : unknown
v3 : 6.4
CPE cpe:2.3:a:hitreach:allow_php_in_posts_and_pages:*:*:*:*:*:wordpress:*:*
References (MISC) https://www.wordfence.com/threat-intel/vulnerabilities/id/3d8b4bb6-3715-40c1-8140-7fcf874ccec3?source=cve - (MISC) https://www.wordfence.com/threat-intel/vulnerabilities/id/3d8b4bb6-3715-40c1-8140-7fcf874ccec3?source=cve - Third Party Advisory
References (MISC) https://plugins.trac.wordpress.org/browser/allow-php-in-posts-and-pages/trunk/allowphp.php#L373 - (MISC) https://plugins.trac.wordpress.org/browser/allow-php-in-posts-and-pages/trunk/allowphp.php#L373 - Patch

17 Sep 2023, 12:01

Type Values Removed Values Added
New CVE
Information

Published : 2023-09-16 02:15

Updated : 2024-11-21 08:36

NVD link : CVE-2023-4994

Mitre link : CVE-2023-4994

CVE.ORG link : CVE-2023-4994

JSON object : View

Products Affected

hitreach

  • allow_php_in_posts_and_pages
CWE

No CWE.