Remote Code Execution Vulnerability in WordPress Blog Plugin by Vendor
CVE-2023-5815

9.8CRITICAL

Key Information:

Vendor
Wordpress
Status
News & Blog Designer Pack – WordPress Blog Plugin — (Blog Post Grid, Blog Post Slider, Blog Post Carousel, Blog Post Ticker, Blog Post Masonry)
Vendor
CVE Published:
22 November 2023

Summary

The News & Blog Designer Pack plugin for WordPress is susceptible to Remote Code Execution due to improper handling of user input in the bdp_get_more_post function. This vulnerability allows unauthenticated attackers to exploit unsafe extraction methods for POST variables, which may lead to the inclusion of arbitrary PHP files. Particularly, vulnerable Docker setups could enable attackers to create PHP files and execute them remotely, posing a significant risk to website security. Users are strongly advised to update to the latest version to mitigate this threat.

Affected Version(s)

News & Blog Designer Pack – WordPress Blog Plugin — (Blog Post Grid, Blog Post Slider, Blog Post Carousel, Blog Post Ticker, Blog Post Masonry) * <= 3.4.1

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://wordpress.org/plugins/blog-designer-pack/
https://plugins.trac.wordpress.org/changeset?sfp_email=&s...

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Florian Hauser
.