PT-2022-3501 · WordPress · Custom-Content-Type-Manager

Iain Wallace · Published 2022-07-06 · Updated 2022-07-14 · CVE-2015-3173

Positive Technologies (AI Summary)

CVSS v2.0

8.5

High

Base vector

AV:N/AC:M/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions custom-content-type-manager Wordpress plugin (affected versions not specified)

Description The issue is related to incorrect code generation management in the custom-content-type-manager plugin for WordPress. It allows a remote attacker to execute arbitrary PHP code. This can be achieved by an administrator, enabling arbitrary remote code execution.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

BDU:2022-04282

CVE-2015-3173

Affected Products

Custom-Content-Type-Manager

References · 7

• 🔥 https://wpscan.com/vulnerability/6b3d0736-7f08-4403-95eb-4385cb206f9e · Exploit
• 🔥 https://blog.nettitude.com/uk/custom-content-type-manager-remote-code-execution · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2015-3173 · Security Note
• https://bdu.fstec.ru/vul/2022-04282 · Security Note
• https://github.com/craftsmancoding/custom-content-type-manager/blob/master/readme.txt · Note
• https://t.me/cibsecurity/45704 · Telegram Post
• https://t.me/cvenotify/32708 · Telegram Post