Allow PHP Execute <= 1.0 - Authenticated (Editor+) PHP Code Injection

The Allow PHP Execute plugin for WordPress is vulnerable to PHP Code Injection in all versions up to, and including, 1.0. This is due to allowing PHP code to be entered by all users for whom unfiltered HTML is allowed. This makes it possible for authenticated attackers, with Editor-level access and above, to inject PHP code into posts and pages.

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

对生成代码的控制不恰当(代码注入)

WordPress plugin Allow PHP Execute 代码注入漏洞

WordPress和WordPress plugin都是WordPress基金会的产品。WordPress是一套使用PHP语言开发的博客平台。该平台支持在PHP和MySQL的服务器上架设个人博客网站。WordPress plugin是一个应用插件。 WordPress plugin Allow PHP Execute 1.0版本存在代码注入漏洞，该漏洞源于允许PHP代码输入，可能导致PHP代码注入。

N/A

N/A