7.5

CVE-2024-13926

Exploit

WP-Syntax <= 1.2 - Author+ Potential ReDoS

WP-Syntax <= 1.2 - Authenticated (Author+) Regex Denial of Service

The WP-Syntax WordPress plugin through 1.2 does not properly handle input, allowing an attacker to create a post containing a large number of tags, thereby exploiting a catastrophic backtracking issue in the regular expression processing to cause a DoS.
Mögliche Gegenmaßnahme
WP-Syntax: No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Connections-pro ≫ Wp-syntax SwPlatformwordpress Version <= 1.2
Weitere Schwachstelleninformationen
SystemWordPress Plugin
≫
Produkt WP-Syntax
Version *-1.2
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.47% 0.38
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
CISA-ADP 7.5 3.9 3.6
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-1333 Inefficient Regular Expression Complexity

The product uses a regular expression with a worst-case computational complexity that is inefficient and possibly exponential.

https://wpscan.com/vulnerability/b5f0092e-7cd5-412f-a8ea-7bd4a8bf86d2/
Third Party Advisory
Exploit
https://www.wordfence.com/threat-intel/vulnerabilities/id/c28bc239-c77b-4a64-a0bf-edde7d61e268
Third Party Advisory