Skip to content
CVE PROGRAM SOURCE RECORD9.9 Critical

CVE-2022-24664

Remote Code Execution by by Contributor+ users via WordPress metabox

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Wordfence

Description

PHP Everywhere <= 2.0.3 included functionality that allowed execution of PHP Code Snippets via WordPress metaboxes, which could be used by any user able to edit posts.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Alexander Fuchs PHP Everywhere

  • 2.0.3 to ≤ 2.0.3affected

References