CVE-2023-5201
🟠 Łataj w tym tygodniu
Wtyczka OpenHook dla WordPressa umożliwia zdalne wykonanie kodu dla uwierzytelnionych atakujących.
CVSS
9.9
EPSS
7.0%
Exploit
none
Vendor
rickbeckman
Opis źródłowy (NVD)
The OpenHook plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 4.3.0 via the 'php' shortcode. This allows authenticated attackers with subscriber-level permissions or above, to execute code on the server. This requires the [php] shortcode setting to be enabled on the vulnerable site.
rce
Brak patcha
Źródła i daty
| Źródło | Wartość |
|---|---|
| NVD – CVSS | 9.9 |
| CISA KEV (aktywnie wykorzystywane) | Nie |
| FIRST EPSS (prawdopodobieństwo exploita) | 7.0% |
| Opublikowano (NVD) | 2023-09-30 03:15:09 UTC |
| Ostatnia modyfikacja (NVD) | 2026-04-08 18:18:24 UTC |
Referencje
- https://plugins.trac.wordpress.org/browser/thesis-openhook/tags/4.3.0/inc/shortcodes.php#L28 (security@wordfence.com) [Third Party Advisory]
- https://plugins.trac.wordpress.org/browser/thesis-openhook/tags/4.3.1/inc/shortcodes.php?rev=2972840#L24 (security@wordfence.com) [Third Party Advisory]
- https://www.wordfence.com/threat-intel/vulnerabilities/id/37b9ed0e-5af2-47c1-b2da-8d103e4c31bf?source=cve (security@wordfence.com) [Third Party Advisory]