PT-2025-10422 · WordPress · Allow Php Execute

Francesco Carlucci · Published 2025-03-08 · Updated 2025-03-13 · CVE-2024-13890

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Allow PHP Execute plugin for WordPress versions prior to 1.1

Description The issue allows PHP code to be entered by all users for whom unfiltered HTML is allowed, making it possible for authenticated attackers with Editor-level access and above to inject PHP code into posts and pages.

Recommendations For versions prior to 1.1, update to a version that fixes the PHP Code Injection issue to prevent authenticated attackers from injecting PHP code into posts and pages.

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2024-13890

Affected Products

Allow Php Execute

References · 12

• https://nvd.nist.gov/vuln/detail/CVE-2024-13890 · Security Note
• https://osv.dev/vulnerability/CVE-2024-13890 · Vendor Advisory
• https://t.me/cvetracker/18723 · Telegram Post
• https://t.me/cvenotify/113970 · Telegram Post
• https://plugins.trac.wordpress.org/browser/allow-php-execute/trunk/allow-php-execute.php#L10 · Note
• https://twitter.com/VulmonFeeds/status/1898219663466618928 · Twitter Post
• https://t.me/cvedetector/19879 · Telegram Post
• https://twitter.com/cracbot/status/1900139846771106093 · Twitter Post
• https://t.me/cvenotify/114489 · Telegram Post
• https://twitter.com/cybercronai/status/1898584909716812244 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/412c39e9-9378-4c2c-817c-8d37f156af6e?source=cve · Note
• https://twitter.com/CVEnew/status/1898246334240456750 · Twitter Post