WordPress Nexter Extension Plugin <= 2.0.3 is vulnerable to Remote Code Execution (RCE)
CVE-2023-45751

9.1CRITICAL

Key Information:

Vendor
WordPress
Status
Nexter Extension
Vendor
CVE Published:
29 December 2023

Summary

An improper control of code generation vulnerability has been identified in the POSIMYTH Nexter Extension for WordPress. This flaw allows for code injection, potentially permitting unauthorized remote code execution. The issue affects versions of Nexter Extension from n/a through 2.0.3, and users are encouraged to review their installations to ensure they are not exposed to exploits related to this security flaw.

Affected Version(s)

Nexter Extension <= 2.0.3

References

https://patchstack.com/database/vulnerability/nexter-exte...
vdb-entry

CVSS V3.1

Score:
9.1
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Rafie Muhammad (Patchstack)
.