CVE-2024-8512 – W3SPEEDSTER <= 7.26 - Authenticated (Administrator+) Remote Code Execution

https://notcve.org/view.php?id=CVE-2024-8512

29 Oct 2024 — The W3SPEEDSTER plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 7.26 via the 'script' parameter of the hookBeforeStartOptimization() function. This is due to the plugin passing user supplied input to eval(). This makes it possible for authenticated attackers, with Administrator-level access and above, to execute code on the server. El complemento W3SPEEDSTER para WordPress es vulnerable a la ejecución remota de código en todas las versiones hasta la 7.26 inc... • https://plugins.trac.wordpress.org/browser/w3speedster-wp/trunk/w3speedster.php#L740 • CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') •