PT-2025-17719 · WordPress · Verification Sms With Targetsms Plugin

Cheng Liu

·

Publicado

2025-04-24

·

Atualizado

2025-05-27

·

CVE-2025-3776

CVSS v3.1

8.3

Alta

VetorAV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L
Name of the Vulnerable Software and Affected Versions Verification SMS with TargetSMS plugin for WordPress versions up to, and including, 1.5
Description The issue is related to limited Remote Code Execution in the Verification SMS with TargetSMS plugin for WordPress. This vulnerability is due to a lack of validation on the type of function that can be called via the targetvr ajax handler function. As a result, unauthenticated attackers can execute any callable function on the site, such as phpinfo().
Recommendations For versions up to, and including, 1.5, consider disabling the targetvr ajax handler function until a patch is available to prevent exploitation. Restrict access to the admin-ajax.php endpoint to minimize the risk of exploitation. Avoid using the vulnerable plugin until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Code Injection

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

CVE-2025-3776

Produtos afetados

Verification Sms With Targetsms Plugin