CVE-2024-37109CWE-94

WordPress WishList Member X plugin < 3.26.7 - Authenticated Arbitrary PHP Code Execution vulnerability

Critical · published June 24, 2024

CVSS v3.1
9.9
EPSS
1%
Percentile
44.1
In the wild
Unconfirmed
What it is

🔥 A sneaky code injection vulnerability lurks in WishList Member X, letting attackers run arbitrary code like a magician pulling rabbits out of a hat! 🎩 Think of this as a restaurant where anyone can walk into the kitchen and cook whatever dish they want without anyone checking — complete chaos! 🍽️ An attacker could exploit this flaw to execute malicious code on your server. This means they could potentially steal sensitive data, modify content, or even take over the entire system. The implications could be absolutely devastating for your users and your business!

Put simply

Think of this as a restaurant where anyone can walk into the kitchen and cook whatever dish they want without anyone checking — complete chaos! 🍽️ This code injection vulnerability in WishList Member X allows attackers to insert and execute malicious code due to improper controls, affecting versions before 3.26.7.

What to do

An attacker could exploit this flaw to execute malicious code on your server. This means they could potentially steal sensitive data, modify content, or even take over the entire system. The implications could be absolutely devastating for your users and your business! Update immediately to version 3.26.7 or later to patch this vulnerability. Review your security settings and ensure code validation measures are in place to prevent such attacks in the future. Don't wait — secure your application now! You've got this! Follow these steps and you'll have your systems secured in no time. 🛡️

The record
Technical detail
CVSS v3.1
9.9 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00532 · 44.1th percentile
Weakness
CWE-94 · Improper Control of Generation of Code ('Code Injection')
Published
2024-06-24T12:29Z
EPSS history
Timeline
  • 24 JUN 12:29Z
    WordPress WishList Member X plugin < 3.26.7 - Authenticated Arbitrary PHP Code Execution vulnerability
    cvelistv5