Unauthenticated Code Execution Vulnerability in JS Help Desk WordPress Plugin

CVE-2024-7094

What is CVE-2024-7094?

The JS Help Desk – The Ultimate Help Desk & Support Plugin for WordPress has a significant vulnerability that allows PHP code injection through the 'storeTheme' function. This flaw is attributed to inadequate sanitization of user-input values, which can lead to unauthorized alterations in the style.php file. These weaknesses provide a pathway for unauthenticated attackers to execute arbitrary code on the server. The vulnerability exists in all versions prior to 2.8.6, which partially addressed the code injection risk. Comprehensive patches were further implemented in version 2.8.7, adding necessary authorization and cross-site request forgery protections.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References