// For flags

CVE-2023-5199

PHP to Page <= 0.3 - Authenticated (Subscriber+) Local File Inclusion to Remote Code Execution via Shortcode

Severity Score

8.8
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

1
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

The PHP to Page plugin for WordPress is vulnerable Local File Inclusion to Remote Code Execution in versions up to, and including, 0.3 via the 'php-to-page' shortcode. This allows authenticated attackers with subscriber-level permissions or above, to include local file and potentially execute code on the server. While subscribers may need to poison log files or otherwise get a file installed in order to achieve remote code execution, author and above users can upload files by default and achieve remote code execution easily.

El complemento PHP to Page para WordPress es vulnerable a la Inclusión de Archivos Locales en la Ejecución Remota de Código en versiones hasta la 0.3 incluida a través del shortcode 'php-to-page'. Esto permite a atacantes autenticados con permisos de nivel de suscriptor o superiores incluir archivos locales y potencialmente ejecutar código en el servidor. Si bien es posible que los suscriptores necesiten envenenar los archivos de registro o instalar un archivo para lograr la ejecución remota del código, los usuarios autores y superiores pueden cargar archivos de forma predeterminada y lograr la ejecución remota del código fácilmente.

*Credits: Lana Codes
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Changed
Confidentiality
High
Integrity
High
Availability
High
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2023-09-26 CVE Reserved
  • 2023-10-29 CVE Published
  • 2024-08-02 CVE Updated
  • 2024-08-02 First Exploit
  • 2024-09-05 EPSS Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
CWE
  • CWE-98: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')
  • CWE-552: Files or Directories Accessible to External Parties
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Php To Page Project
Search vendor "Php To Page Project"
 Php To Page
Search vendor "Php To Page Project" for product "Php To Page"
 <= 0.3
Search vendor "Php To Page Project" for product "Php To Page" and version " <= 0.3"
wordpress
Affected