Unauthenticated Arbitrary Shortcode Execution Vulnerability in The Affiliate Super Assistent Plugin for WordPress

CVE-2024-8478

What is CVE-2024-8478?

The Affiliate Super Assistant plugin for WordPress introduces a vulnerability that permits arbitrary shortcode execution across all versions up to and including 1.5.3. This security issue arises when users are allowed to include arbitrary shortcodes within comments, specifically when the 'Parse comments' feature is activated. As a result, unauthenticated attackers have the potential to leverage this flaw to execute arbitrary shortcodes, which could lead to unauthorized actions and compromise the integrity of the WordPress site.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References