PT-2026-21888 · WordPress · Advanced Woo Labels

Os

+1

·

Publicado

2026-02-25

·

Atualizado

2026-03-02

·

CVE-2026-1929

CVSS v3.1

8.8

Alta

VetorAV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions Advanced Woo Labels versions prior to 2.3
Description The Advanced Woo Labels plugin for WordPress is susceptible to Remote Code Execution due to the use of call user func array() with user-controlled callback and parameters in the get select option values() AJAX handler. The lack of an allowlist of permitted callbacks or a capability check allows authenticated attackers with Contributor-level access or higher to execute arbitrary PHP functions and potentially operating system commands on the server via the callback parameter.
Recommendations Update Advanced Woo Labels to a version later than 2.3.

Correção

RCE

Code Injection

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

CVE-2026-1929

Produtos afetados

Advanced Woo Labels