WordPress · Similar Posts · CVE-2021-24537
**Name of the Vulnerable Software and Affected Versions**
Similar Posts WordPress plugin versions 3.1.5 and earlier
**Description**
The issue allows high privilege users to execute arbitrary PHP code in a hardened environment, where DISALLOW FILE EDIT, DISALLOW FILE MODS, and DISALLOW UNFILTERED HTML are set to true. This is achieved via the `widget rrm similar posts condition` widget setting of the plugin.
**Recommendations**
For versions 3.1.5 and earlier, consider disabling the `widget rrm similar posts condition` widget setting to prevent exploitation until a patch is available. Restrict access to the plugin's settings for high privilege users to minimize the risk of arbitrary PHP code execution.