Code Injection Vulnerability in MDTF Could Allow Attackers to Execute Malicious Code
CVE-2024-50450

7.3HIGH

Key Information:

Vendor

WordPress
Status
Mdtf
Vendor
CVE Published:
28 October 2024

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2024-50450?

A code injection vulnerability exists in the WordPress Meta Data and Taxonomies Filter (MDTF) plugin due to improper control of code generation processes. This vulnerability can allow attackers to inject arbitrary code, potentially compromising the WordPress installation and leading to unauthorized access or loss of data. Affected versions include all prior to 1.3.3.4. Site administrators using these versions should take immediate action to update and mitigate risks associated with this vulnerability.

Affected Version(s)

MDTF 0 <= 1.3.3.4

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2024-50450
Created by RandomRobbieBF

References

https://patchstack.com/database/Wordpress/Plugin/wp-meta-...
vdb-entry

CVSS V3.1

Score:
7.3
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Dimas Maulana (Patchstack Alliance)
.