Static Snapshot WordPress plugin unauthenticated remote command execution
A WordPress plugin lets anyone hack the server without logging in!
Summary
The Static Snapshot WordPress plugin does not filter shell metacharacters in a user-supplied value, letting unauthenticated attackers run arbitrary commands on the server. Versions through 0.2.1 are affected.
What to do
No fix is known. Check that the plugin runs a version newer than 0.2.1 and read the vendor's advisory.
Products and platforms
CVE IDs
Sources
- Write-up: wpscan.com (opens in a new tab)
- CVE record: cve.org (opens in a new tab)
Times
First published
First seen