7.3

CVE-2024-9846

Enable Shortcodes inside Widgets,Comments and Experts <= 1.0.0 - Unauthenticated Arbitrary Shortcode Execution

Enable Shortcodes inside Widgets,Comments and Experts <= 1.0.0 - Unauthenticated Arbitrary Shortcode Execution

The The Enable Shortcodes inside Widgets,Comments and Experts plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.0.0. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
Mögliche Gegenmaßnahme
Enable Shortcodes inside Widgets,Comments and Experts: No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Aftabhusain ≫ Enable Shortcodes Inside Widgets,comments And Experts SwPlatformwordpress Version <= 1.0.0
Weitere Schwachstelleninformationen
SystemWordPress Plugin
≫
Produkt Enable Shortcodes inside Widgets,Comments and Experts
Version *-1.0.0
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.54% 0.412
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
security@wordfence.com 7.3 3.9 3.4
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
CWE-94 Improper Control of Generation of Code ('Code Injection')

The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

https://plugins.trac.wordpress.org/browser/enable-shortcodes-inside-widgetscomments-and-experts/trunk/enable-shortcodes-inside-widgets-comments-experts.php#L19
Product
https://wordpress.org/plugins/enable-shortcodes-inside-widgetscomments-and-experts/#developers
Product
https://www.wordfence.com/threat-intel/vulnerabilities/id/f1ac2544-f96b-4859-96de-795753a94264?source=cve
Third Party Advisory
https://www.wordfence.com/threat-intel/vulnerabilities/id/f1ac2544-f96b-4859-96de-795753a94264
Third Party Advisory