CVE-2021-24537CWE-94

Similar Posts <= 3.1.5 - Admin+ Arbitrary PHP Code Execution

published November 8, 2021

CVSS
—
EPSS
2%
Percentile
75.1
In the wild
Unconfirmed
What it is

The Similar Posts WordPress plugin through 3.1.5 allow high privilege users to execute arbitrary PHP code in an hardened environment (ie with DISALLOW_FILE_EDIT, DISALLOW_FILE_MODS and DISALLOW_UNFILTERED_HTML set to true) via the 'widget_rrm_similar_posts_condition' widget setting of the plugin.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01564 · 75.1th percentile
Weakness
CWE-94 · Improper Control of Generation of Code ('Code Injection')
Published
2021-11-08T17:34Z
EPSS history
Timeline
  • 08 NOV 17:34Z
    Similar Posts <= 3.1.5 - Admin+ Arbitrary PHP Code Execution
    cvelistv5