Code Injection Vulnerability in MDTF Could Allow Attackers to Execute Malicious Code
CVE-2024-50450

9.8CRITICAL

Key Information:

Vendor
Wordpress
Status
WordPress Meta Data And Taxonomies Filter (mdtf)
Vendor
CVE Published:
28 October 2024

Badges

👾 Exploit Exists🟡 Public PoC

Summary

A code injection vulnerability exists in the WordPress Meta Data and Taxonomies Filter (MDTF) plugin due to improper control of code generation processes. This vulnerability can allow attackers to inject arbitrary code, potentially compromising the WordPress installation and leading to unauthorized access or loss of data. Affected versions include all prior to 1.3.3.4. Site administrators using these versions should take immediate action to update and mitigate risks associated with this vulnerability.

Affected Version(s)

WordPress Meta Data and Taxonomies Filter (MDTF) <= 1.3.3.4

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2024-50450
Created by RandomRobbieBF

References

https://patchstack.com/database/vulnerability/wp-meta-dat...
vdb-entry

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Dimas Maulana (Patchstack Alliance)
.