CVE-2024-8512 – W3SPEEDSTER <= 7.26 - Authenticated (Administrator+) Remote Code Execution

https://notcve.org/view.php?id=CVE-2024-8512

The W3SPEEDSTER plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 7.26 via the 'script' parameter of the hookBeforeStartOptimization() function. This is due to the plugin passing user supplied input to eval(). This makes it possible for authenticated attackers, with Administrator-level access and above, to execute code on the server. El complemento W3SPEEDSTER para WordPress es vulnerable a la ejecución remota de código en todas las versiones hasta la 7.26 incluida a través del parámetro 'script' de la función hookBeforeStartOptimization(). Esto se debe a que el complemento pasa la información proporcionada por el usuario a eval(). • https://plugins.trac.wordpress.org/browser/w3speedster-wp/trunk/w3speedster.php#L740 https://plugins.trac.wordpress.org/changeset/3175640 https://www.wordfence.com/threat-intel/vulnerabilities/id/2a56eb63-ba5c-4452-8ab9-f5aeaf53adda?source=cve • CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') •