CVE-2023-53872CWE-78

Wp2Fac 1.0 OS Command Injection via send.php Endpoint

Critical · published December 15, 2025

CVSS v4.0
9.3
EPSS
1%
Percentile
65.9
In the wild
Unconfirmed
What it is

Wp2Fac 1.0 contains an OS command injection vulnerability in the send.php endpoint that allows remote attackers to execute arbitrary system commands. Attackers can inject shell commands through the 'numara' parameter by appending shell commands with '&' operators to execute malicious code.

The record
Technical detail
CVSS v4.0
9.3 · CRITICAL
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.01122 · 65.9th percentile
Weakness
CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published
2025-12-15T20:28Z
EPSS history
Timeline
  • 15 DEC 20:28Z
    Wp2Fac 1.0 OS Command Injection via send.php Endpoint
    cvelistv5