Allow PHP in Posts and Pages < 3.0.4 - Authenticated Remote Code Execution (RCE)

2023-09-2000:00:00

wpscan.com

wordpress

remote code execution

authenticated

AI Score

7.6

Confidence

High

EPSS

0.001

Percentile

36.5%

JSON

Description The Allow PHP in Posts and Pages plugin for WordPress is vulnerable to Remote Code Execution via the ‘php’ shortcode. This allows authenticated attackers with subscriber-level permissions or above, to execute code on the server.

References

www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/allow-php-in-posts-and-pages/allow-php-in-posts-and-pages-304-authenticated-subscriber-remote-code-execution-via-shortcode