CVE-2023-46623CWE-94

WordPress WP EXtra Plugin <= 6.2 is vulnerable to Remote Code Execution (RCE)

Critical · published December 29, 2023

CVSS v3.1
9.9
EPSS
1%
Percentile
47.2
In the wild
Unconfirmed
What it is

🔥 A code injection vulnerability in TienCOP WP EXtra could let attackers run arbitrary code on your site without breaking a sweat! ⚡ Think of this as an unmonitored kitchen where anyone can walk in and start cooking without any safety checks—your delicious recipe could easily turn into a disaster! An attacker could hijack your WordPress site, install malware, or even steal sensitive data. The consequences could be absolutely devastating, compromising not just your site but also your users' trust!

Put simply

Think of this as an unmonitored kitchen where anyone can walk in and start cooking without any safety checks—your delicious recipe could easily turn into a disaster! This vulnerability allows code injection due to improper controls in the TienCOP WP EXtra plugin, which could enable attackers to execute arbitrary commands when given the right inputs.

What to do

An attacker could hijack your WordPress site, install malware, or even steal sensitive data. The consequences could be absolutely devastating, compromising not just your site but also your users' trust! Update your TienCOP WP EXtra plugin to version 6.2 or later immediately. Conduct a thorough security audit of your site and implement security measures to filter user inputs. You've got this! By patching up and tightening security, you'll ensure your site stays safe and sound. 🛡️

The record
Technical detail
CVSS v3.1
9.9 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00584 · 47.2th percentile
Weakness
CWE-94 · Improper Control of Generation of Code ('Code Injection')
Published
2023-12-29T09:06Z
EPSS history
Timeline
  • 29 DEC 09:06Z
    WordPress WP EXtra Plugin <= 6.2 is vulnerable to Remote Code Execution (RCE)
    cvelistv5