Unauthenticated Arbitrary Shortcode Execution Vulnerability in The Affiliate Super Assistent Plugin for WordPress
CVE-2024-8478
7.3HIGH
Key Information:
- Vendor
Wordpress
- Vendor
- CVE Published:
- 10 September 2024
What is CVE-2024-8478?
The Affiliate Super Assistant plugin for WordPress introduces a vulnerability that permits arbitrary shortcode execution across all versions up to and including 1.5.3. This security issue arises when users are allowed to include arbitrary shortcodes within comments, specifically when the 'Parse comments' feature is activated. As a result, unauthenticated attackers have the potential to leverage this flaw to execute arbitrary shortcodes, which could lead to unauthorized actions and compromise the integrity of the WordPress site.
Affected Version(s)
Affiliate Super Assistent * <= 1.5.3