Description

WordPress Plugin Britetechs Companion contains malicous code. Exploiting this issue may allow an attacker to create a new administrative user account, thus compromising the affected application, and possibly the webserver or computer. WordPress Plugin Britetechs Companion version 2.2.7 is affected.

Remediation

Update to plugin version 2.2.8 or latest

References

https://www.wordfence.com/threat-intel/vulnerabilities/detail/several-wordpressorg-plugins-various-versions-injected-backdoor

https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3109550%40britetechs-companion&old=3109493%40britetechs-companion&sfp_email=&sfph_mail=

Related Vulnerabilities

WordPress Plugin The Piecemaker 'php.php' Arbitrary File Upload (1.1)

Joomla! Core 3.2.x Cross-Site Scripting (3.2.0 - 3.2.4)

Drupal Core 9.0.x Multiple Cross-Site Scripting Vulnerabilities (9.0.0 - 9.0.5)

WebLogic CVE-2016-3505 Vulnerability (CVE-2016-3505)

MySQL CVE-2015-0423 Vulnerability (CVE-2015-0423)

Severity

High

Classification

CVE-2024-6297 CWE-506 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Tags

Missing Update