PT-2018-15277 · WordPress · Wp Maintenance Mode

Published 2018-12-14 · Updated 2019-01-07 · CVE-2018-20156

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions WP Maintenance Mode plugin versions prior to 2.0.7

Description The issue allows remote authenticated site administrator users to execute arbitrary PHP code throughout a multisite network.

Recommendations For WP Maintenance Mode plugin versions prior to 2.0.7, update to version 2.0.7 or later to resolve the issue.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2018-20156

Affected Products

Wp Maintenance Mode

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2018-20156 · Security Note
• https://osv.dev/vulnerability/CVE-2018-20156 · Vendor Advisory
• https://wordfence.com/blog/2016/07/3-vulnerabilities-wp-maintenance-mode · Note