Remote Code Execution by by Contributor+ users via WordPress metabox
CVE-2022-24664

9.9CRITICAL

Key Information:

Vendor
Wordpress
Status
PHP Everywhere
Vendor
CVE Published:
16 February 2022

Summary

PHP Everywhere <= 2.0.3 included functionality that allowed execution of PHP Code Snippets via WordPress metaboxes, which could be used by any user able to edit posts.

Affected Version(s)

PHP Everywhere WordPress 2.0.3

References

https://www.wordfence.com/blog/2022/02/critical-vulnerabi...
x_refsource_MISC

CVSS V3.1

Score:
9.9
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Ramuel Gall, Wordfence
.