// For flags

CVE-2023-4994

Allow PHP in Posts and Pages <= 3.0.4 - Authenticated (Subscriber+) Remote Code Execution via Shortcode

Severity Score

6.4
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

The Allow PHP in Posts and Pages plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 3.0.4 via the 'php' shortcode. This allows authenticated attackers with subscriber-level permissions or above, to execute code on the server.

El complemento Allow PHP in Posts and Pages para WordPress es vulnerable a la Ejecución Remota de Código en versiones hasta la 3.0.4 inclusive a través del código corto 'php'. Esto permite a atacantes autenticados con permisos de nivel de suscriptor o superiores ejecutar código en el servidor.

*Credits: Lana Codes
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Changed
Confidentiality
Low
Integrity
Low
Availability
None
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Changed
Confidentiality
High
Integrity
High
Availability
High
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2023-09-15 CVE Reserved
  • 2023-09-15 CVE Published
  • 2024-08-02 CVE Updated
  • 2024-10-18 EPSS Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-94: Improper Control of Generation of Code ('Code Injection')
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Hitreach
Search vendor "Hitreach"
Allow Php In Posts And Pages
Search vendor "Hitreach" for product "Allow Php In Posts And Pages"
<= 3.0.4
Search vendor "Hitreach" for product "Allow Php In Posts And Pages" and version " <= 3.0.4"
wordpress
Affected