PT-2020-12683 · WordPress · Search Meter

Published 2020-04-04 · Updated 2021-07-21 · CVE-2020-11548

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Search Meter plugin versions through 2.13.2

Description The issue allows user input introduced in the search bar to be any formula, potentially leading to remote code execution via CSV injection if a specific export is performed, specifically when accessing the "wp-admin/index.php?page=search-meter" endpoint and performing an Export action.

Recommendations For versions through 2.13.2, update to a version that fixes this issue to prevent remote code execution via CSV injection. As a temporary workaround, consider restricting access to the "wp-admin/index.php?page=search-meter" endpoint to minimize the risk of exploitation. Avoid performing the Export action on the Search Meter plugin until the issue is resolved.

Fix

RCE

Weakness Enumeration

CWE-1236

Related Identifiers

CVE-2020-11548

Affected Products

Search Meter

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2020-11548 · Security Note
• https://osv.dev/vulnerability/CVE-2020-11548 · Vendor Advisory
• https://wordpress.org/plugins/search-meter/#developers · Note
• https://t.me/cvenotify/2416 · Telegram Post
• https://exploit-db.com/exploits/48197 · Note