Description

WordPress Plugin Ad Invalid Click Protector (AICP) contains malicous code. Exploiting this issue may allow an attacker to create a new administrative user account, thus compromising the affected application, and possibly the webserver or computer. WordPress Plugin Ad Invalid Click Protector (AICP) version 1.2.9 is affected.

Remediation

Update to plugin version 1.2.11 or latest

References

https://www.wordfence.com/blog/2024/06/3-more-plugins-infected-in-wordpress-org-supply-chain-attack-due-to-compromised-developer-passwords/

https://plugins.trac.wordpress.org/changeset/3109320

Related Vulnerabilities

Piwigo Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Vulnerability (CVE-2021-40313)

Atlassian Jira URL Redirection to Untrusted Site ('Open Redirect') Vulnerability (CVE-2019-11589)

Moodle CVE-2023-5551 Vulnerability (CVE-2023-5551)

WebLogic CVE-2018-11039 Vulnerability (CVE-2018-11039)

TYPO3 Improper Input Validation Vulnerability (CVE-2011-4904)

Severity

High

Classification

CVE-2024-6297 CWE-506 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Tags

Missing Update