Description

WordPress Plugin Woody ad snippets-Insert Header Footer Code, AdSense Ads is prone to a vulnerability that lets attackers inject and execute arbitrary code because the application fails to sanitize user-supplied input. Attackers can exploit this issue to execute arbitrary PHP code within the context of the affected webserver process. WordPress Plugin Woody ad snippets-Insert Header Footer Code, AdSense Ads version 1.3 is vulnerable; prior versions may also be affected.

Remediation

Disable the plugin until a fix is available

References

https://sumofpwn.nl/advisory/2016/insert_php_wordpress_plugin_allows_authenticated_user_to_execute_arbitrary_php.html

https://packetstormsecurity.com/files/138118/WordPress-Insert-PHP-1.3-Code-Execution.html

Related Vulnerabilities

WordPress Plugin Store Locator Plus for WordPress Privilege Escalation (5.5.14)

WordPress Plugin WP GDPR Multiple Vulnerabilities (2.1.1)

XWiki Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') Vulnerability (CVE-2022-41931)

WordPress Plugin WooCommerce Extra Product Options Multiple Vulnerabilities (4.5.3)

WordPress Plugin Fancy Product Designer-WooCommerce Cross-Site Request Forgery (4.7.5)

Severity

High

Classification

CWE-95 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Tags

Missing Update Code Execution