Unauthenticated Attacker Can Include and Execute PHP Files on Server via Render_Action_Template Parameter

CVE-2023-6989

Summary

The Shield Security – Smart Bot Blocking & Intrusion Prevention Security plugin for WordPress contains a vulnerability that allows for local file inclusion due to an improper handling of the 'render_action_template' parameter. This shortcoming affects all versions up to 18.5.9, enabling unauthenticated attackers to exploit this flaw by including and executing arbitrary PHP files on the server. Such an exploit can lead to a full compromise of the web server, as it permits the execution of any PHP code embedded in the included files, posing a significant threat to the integrity and security of WordPress installations using this plugin.

References