CVE-2024-8512
W3SPEEDSTER <= 7.26 - Authenticated (Administrator+) Remote Code Execution
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
The W3SPEEDSTER plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 7.26 via the 'script' parameter of the hookBeforeStartOptimization() function. This is due to the plugin passing user supplied input to eval(). This makes it possible for authenticated attackers, with Administrator-level access and above, to execute code on the server.
El complemento W3SPEEDSTER para WordPress es vulnerable a la ejecución remota de código en todas las versiones hasta la 7.26 incluida a través del parámetro 'script' de la función hookBeforeStartOptimization(). Esto se debe a que el complemento pasa la información proporcionada por el usuario a eval(). Esto permite que atacantes autenticados, con acceso de nivel de administrador o superior, ejecuten código en el servidor.
CVSS Scores
SSVC
- Decision:Track*
Timeline
- 2024-09-06 CVE Reserved
- 2024-10-29 CVE Published
- 2024-10-30 CVE Updated
- 2024-10-31 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')
CAPEC
References (3)
Affected Vendors, Products, and Versions
Vendor | Product | Version | Other | Status | ||||||
---|---|---|---|---|---|---|---|---|---|---|
Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
W3speedster Search vendor "W3speedster" | W3SPEEDSTER Search vendor "W3speedster" for product "W3SPEEDSTER" | <= 7.26 Search vendor "W3speedster" for product "W3SPEEDSTER" and version " <= 7.26" | en |
Affected
|