Oxygen Builder Plugin Vulnerable to Remote Code Execution

CVE-2024-4662

Summary

The Oxygen Builder plugin for WordPress is susceptible to exploitation due to a vulnerability that allows for Remote Code Execution. This issue affects all versions up to and including 4.8.2 and arises from the manner in which the plugin handles custom data storage in post metadata, specifically the absence of an underscore prefix. This flaw enables lower privileged users, such as contributors, to inject arbitrary PHP code through the WordPress user interface, thereby potentially elevating their privileges and compromising the site’s security.

References