Unauthenticated Arbitrary Shortcode Execution Vulnerability in The Affiliate Super Assistent Plugin for WordPress
CVE-2024-8478

7.3HIGH

Key Information:

Vendor
Wordpress
Status
Affiliate Super Assistent
Vendor
CVE Published:
10 September 2024

Summary

The Affiliate Super Assistant plugin for WordPress introduces a vulnerability that permits arbitrary shortcode execution across all versions up to and including 1.5.3. This security issue arises when users are allowed to include arbitrary shortcodes within comments, specifically when the 'Parse comments' feature is activated. As a result, unauthenticated attackers have the potential to leverage this flaw to execute arbitrary shortcodes, which could lead to unauthorized actions and compromise the integrity of the WordPress site.

Affected Version(s)

Affiliate Super Assistent * <= 1.5.3

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/amazonsimplead...
https://plugins.trac.wordpress.org/changeset?sfp_email=&s...

CVSS V3.1

Score:
7.3
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Francesco Carlucci
.