WordPress Qode Essential Addons Plugin <= 1.5.2 is vulnerable to Remote Code Execution (RCE)
CVE-2023-47840

9.9CRITICAL

Key Information:

Vendor

WordPress
Status
Qode Essential Addons
Vendor
CVE Published:
29 December 2023

Badges

👾 Exploit Exists🟡 Public PoC🟣 EPSS 18%

What is CVE-2023-47840?

An improper control of code generation vulnerability exists in Qode Essential Addons by Qode Interactive. This flaw can allow attackers to exploit the system by injecting malicious code, potentially leading to unauthorized actions and a compromise of the affected WordPress site. Users are encouraged to review their installations and apply any relevant patches or updates to secure their environments.

Affected Version(s)

Qode Essential Addons <= 1.5.2

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2023-47840
Created by RandomRobbieBF

References

https://patchstack.com/database/vulnerability/qode-essent...
vdb-entry

EPSS Score

18% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
9.9
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability Reserved

.