wcmp — Vulnerabilities & Security Advisories 9

WCMP is a WordPress plugin for creating custom post types and managing content, widely used for enhancing website functionality. Historically, it has been susceptible to multiple security vulnerabilities including remote code execution, cross-site scripting, and privilege escalation flaws, with eight CVEs documented. The plugin's complex architecture and extensive permissions have made it a target for attackers. Notable security characteristics include insufficient input validation and inadequate access controls, which have led to several high-severity incidents. In 2021, a critical vulnerability allowed unauthenticated attackers to execute arbitrary code, affecting thousands of websites. Despite patches, ongoing security concerns persist due to the plugin's broad deployment and frequent updates.