CVE-2023-45751CWE-94

WordPress Nexter Extension Plugin <= 2.0.3 is vulnerable to Remote Code Execution (RCE)

Critical · published December 29, 2023

CVSS v3.1
9.1
EPSS
1%
Percentile
53.3
In the wild
Unconfirmed
What it is

🚨 A code injection vulnerability in the POSIMYTH Nexter Extension could allow attackers to execute malicious code on your systems — a hacker's dream! 🔥 Think of it like a restaurant where an unscrupulous diner modifies their order by slipping in hidden ingredients. Without proper checks, the kitchen (your system) might whip up something dangerous! An attacker could exploit this vulnerability to run arbitrary code, potentially compromising sensitive data, altering system functionality, or even taking full control of the server. This could lead to catastrophic data breaches or service disruptions, putting your entire operation at risk!

Put simply

Think of it like a restaurant where an unscrupulous diner modifies their order by slipping in hidden ingredients. Without proper checks, the kitchen (your system) might whip up something dangerous! The vulnerability arises from improper control over code generation, allowing attackers to inject malicious code into the Nexter Extension, which runs with the same permissions as the application itself.

What to do

An attacker could exploit this vulnerability to run arbitrary code, potentially compromising sensitive data, altering system functionality, or even taking full control of the server. This could lead to catastrophic data breaches or service disruptions, putting your entire operation at risk! To protect yourself, immediately update to the latest version that addresses this vulnerability. Conduct a full security audit of your affected systems and ensure appropriate security measures are in place to filter and sanitize inputs. 🚀 This is absolutely fixable! Follow these steps, and you’ll bolster your defenses in no time! 🛡️

The record
Technical detail
CVSS v3.1
9.1 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00719 · 53.3th percentile
Weakness
CWE-94 · Improper Control of Generation of Code ('Code Injection')
Published
2023-12-29T09:02Z
EPSS history
Timeline
  • 29 DEC 09:02Z
    WordPress Nexter Extension Plugin <= 2.0.3 is vulnerable to Remote Code Execution (RCE)
    cvelistv5