PT-2022-9609 · WordPress · Wp Coder

Krzysztof Zając · Published 2022-01-10 · Updated 2022-01-14 · CVE-2021-25053

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions WP Coder WordPress plugin versions prior to 2.5.2

Description The issue allows for the inclusion of arbitrary files with PHP extension, as well as files using data:// or http:// protocols, within the wow-company admin menu page. This can lead to CSRF and remote code execution.

Recommendations For WP Coder WordPress plugin versions prior to 2.5.2, update to version 2.5.2 or later to resolve the issue.

Exploit

Fix

RCE

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2021-25053

Affected Products

Wp Coder

References · 4

• 🔥 https://wpscan.com/vulnerability/a5448599-64de-43b0-b04d-c6492366eab1 · Exploit
• https://osv.dev/vulnerability/CVE-2021-25053 · Vendor Advisory
• https://plugins.trac.wordpress.org/changeset/2641650/wp-coder · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2021-25053 · Security Note