PT-2024-39138 · WordPress · Mdtf

Krzysztof Zając

·

Published

2024-09-23

·

Updated

2024-09-26

·

CVE-2024-8623

CVSS v3.1

7.3

High

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Name of the Vulnerable Software and Affected Versions: MDTF – Meta Data and Taxonomies Filter plugin for WordPress versions up to, and including, 1.3.3.3
Description: The issue is related to arbitrary shortcode execution due to the software allowing users to execute an action that does not properly validate a value before running do shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
Recommendations: For versions up to, and including, 1.3.3.3, consider disabling the execution of shortcodes until a patch is available. Restrict access to the do shortcode function to minimize the risk of exploitation. Avoid using the MDTF plugin until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2024-8623

Affected Products

Mdtf