WordPress Verge3D Plugin <= 4.5.2 is vulnerable to Remote Code Execution (RCE)
CVE-2023-51420

9.1CRITICAL

Key Information:

Vendor
WordPress
Status
Verge3d Publishing And E-commerce
Vendor
CVE Published:
29 December 2023

Summary

The vulnerability in Verge3D Publishing and E-Commerce by Soft8Soft LLC exposes affected versions to potential code injection attacks. This occurs when the application improperly controls the generation of code, allowing attackers to execute malicious code remotely. Users on versions from n/a up to 4.5.2 should take immediate action to patch their systems and mitigate the risk associated with this security flaw.

Affected Version(s)

Verge3D Publishing and E-Commerce <= 4.5.2

References

https://patchstack.com/database/vulnerability/verge3d/wor...
vdb-entry

CVSS V3.1

Score:
9.1
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Rafie Muhammad (Patchstack)
.