WordPress MDTF Plugin Unauthenticated Arbitrary Shortcode Execution (CVE-2024-8623)

From this webpage screenshot, the following key information about the vulnerability can be obtained: 1. Vulnerability Name: MDTF - Meta Data and Taxonomies Filter <= 1.3.3.3 - Unauthenticated Arbitrary Shortcode Execution 2. Vulnerability Severity: CVSS 7.3 (High) 3. Public Release Date: September 23, 2024 4. Last Updated Date: September 24, 2024 5. Researcher: Krzysztof Zając - CERT PL 6. Vulnerability Description: The plugin allows unauthenticated attackers to execute arbitrary shortcodes because the plugin does not properly validate values before running . 7. Remediation Advice: Update to plugin version 1.3.3.4 or higher. 8. Affected Versions: <= 1.3.3.3 9. Fixed Version: 1.3.3.4 10. Vulnerability ID: CVE-2024-8623 11. Vulnerability Type: Improper Control of Generation of Code (Code Injection) 12. Vulnerability Disclosure Status: Public 13. Vulnerability Disclosure Date: September 23, 2024 14. Vulnerability Disclosure Last Update Date: September 24, 2024 15. Vulnerability Disclosure Researcher: Krzysztof Zając - CERT PL 16. Vulnerability Disclosure Description: The plugin allows unauthenticated attackers to execute arbitrary shortcodes because the plugin does not properly validate values before running . 17. Vulnerability Disclosure Remediation Advice: Update to plugin version 1.3.3.4 or higher. 18. Vulnerability Disclosure Affected Versions: <= 1.3.3.3 19. Vulnerability Disclosure Fixed Version: 1.3.3.4 20. Vulnerability Disclosure Vulnerability ID: CVE-2024-8623 21. Vulnerability Disclosure Vulnerability Type: Improper Control of Generation of Code (Code Injection) 22. Vulnerability Disclosure Vulnerability Disclosure Status: Public 23. Vulnerability Disclosure Vulnerability Disclosure Date: September 23, 2024 24. Vulnerability Disclosure Vulnerability Disclosure Last Update Date: September 24, 2024 25. Vulnerability Disclosure Vulnerability Disclosure Researcher: Krzysztof Zając - CERT PL 26. Vulnerability Disclosure Vulnerability Disclosure Description: The plugin allows unauthenticated attackers to execute arbitrary shortcodes because the plugin does not properly validate values before running . 27. Vulnerability Disclosure Vulnerability Disclosure Remediation Advice: Update to plugin version 1.3.3.4 or higher. 28. Vulnerability Disclosure Vulnerability Disclosure Affected Versions: <= 1.3.3.3 29. Vulnerability Disclosure Vulnerability Disclosure Fixed Version: 1.3.3.4 30. Vulnerability Disclosure Vulnerability Disclosure Vulnerability ID: CVE-2024-8623 31. Vulnerability Disclosure Vulnerability Disclosure Vulnerability Type: Improper Control of Generation of Code (Code Injection) 32. Vulnerability Disclosure Vulnerability Disclosure Vulnerability Disclosure Status: Public 33. Vulnerability Disclosure Vulnerability Disclosure Vulnerability Disclosure Date: September 23, 2024 34. Vulnerability Disclosure Vulnerability Disclosure Vulnerability Disclosure Last Update Date: September 24, 2024 35. Vulnerability Disclosure Vulnerability Disclosure Vulnerability Disclosure Researcher: Krzysztof Zając - CERT PL 36. Vulnerability Disclosure Vulnerability Disclosure Vulnerability Disclosure Description: The plugin allows unauthenticated attackers to execute arbitrary shortcodes because the plugin does not properly validate values before running . 37. Vulnerability Disclosure Vulnerability Disclosure Vulnerability Disclosure Remediation Advice: Update to plugin version 1.3.3.4 or higher. 38. Vulnerability Disclosure Vulnerability Disclosure Vulnerability Disclosure Affected Versions: <= 1.3.3.3 39. Vulnerability Disclosure Vulnerability Disclosure Vulnerability Disclosure Fixed Version: 1.3.3.4 40. Vulnerability Disclosure Vulnerability Disclosure Vulnerability Disclosure Vulnerability ID: CVE-2024-8623 41. Vulnerability Disclosure Vulnerability Disclosure Vulnerability Disclosure Vulnerability Type: Improper Control of Generation of Code (Code Injection) 42. Vulnerability Disclosure Vulnerability Disclosure Vulnerability Disclosure Vulnerability Disclosure Status: Public 43. Vulnerability Disclosure Vulnerability Disclosure Vulnerability Disclosure Vulnerability Disclosure Date: September 23, 2024 44. Vulnerability Disclosure Vulnerability Disclosure Vulnerability Disclosure Vulnerability Disclosure Last Update Date: September 24, 2024 45. Vulnerability Disclosure Vulnerability Disclosure Vulnerability Disclosure Vulnerability Disclosure Researcher: Krzysztof Zając - CERT PL 46. Vulnerability Disclosure Vulnerability Disclosure Vulnerability Disclosure Vulnerability Disclosure Description: The plugin allows unauthenticated attackers to execute arbitrary shortcodes because the plugin does not properly validate values before running . 47. Vulnerability Disclosure Vulnerability Disclosure Vulnerability Disclosure Vulnerability Disclosure Remediation Advice: Update to plugin version 1.3.3.4 or higher. 48. Vulnerability Disclosure Vulnerability Disclosure Vulnerability Disclosure Vulnerability Disclosure Affected

Goal Reached Thanks to every supporter — we hit 100%!

WordPress MDTF Plugin Unauthenticated Arbitrary Shortcode Execution (CVE-2024-8623)