PT-2025-51290 · WordPress · Wp2Fac

Published 2025-12-15 · Updated 2025-12-21 · CVE-2023-53872

Positive Technologies (AI Summary)

CVSS v4.0

9.3

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Wp2Fac version 1.0

Description The software contains an OS command injection issue in the send.php endpoint. This allows remote attackers to execute arbitrary system commands. The issue occurs because attackers can inject shell commands through the numara parameter by appending shell commands with '&' operators. This enables the execution of malicious code.

Recommendations Update to a newer version that contains a fix for this vulnerability. As a temporary workaround, restrict access to the send.php endpoint. Avoid using the numara parameter in the affected API endpoint until the issue is resolved.

Exploit

Fix

RCE

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2023-53872

Affected Products

Wp2Fac

References · 7

• 🔥 https://exploit-db.com/exploits/51717 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-53872 · Security Note
• https://github.com/metinyesil/wp2fac · Note
• https://twitter.com/CVEnew/status/2002857377213931668 · Twitter Post
• https://vulncheck.com/advisories/wpfac-os-command-injection-via-sendphp-endpoint · Note
• https://twitter.com/VulmonFeeds/status/2000753466021490845 · Twitter Post
• https://twitter.com/0dayPublishing/status/2000667323988840895 · Twitter Post