CVE-2024-8623

Improper Control of Generation of Code ('Code Injection') (CWE-94)

Published: Sep 24, 2024 / Updated: 57d ago

010
CVSS 7.3EPSS 0.05%High
CVE info copied to clipboard

Summary

The MDTF – Meta Data and Taxonomies Filter plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.3.3.3. This vulnerability stems from the plugin's failure to properly validate a value before running do_shortcode, allowing unauthenticated attackers to execute arbitrary shortcodes.

Impact

This vulnerability allows unauthenticated attackers to execute arbitrary shortcodes, which can lead to code injection. The potential impacts include: 1. Unauthorized code execution: Attackers can run malicious code on the affected WordPress site. 2. Data manipulation: The vulnerability could be exploited to modify or delete content on the website. 3. Privilege escalation: Depending on the shortcodes available, attackers might be able to elevate their privileges on the site. 4. Website defacement: Malicious actors could potentially alter the appearance or content of the website. 5. Further compromise: This vulnerability could serve as an entry point for more severe attacks on the WordPress installation or the hosting server.

Exploitation

There is no evidence that a public proof-of-concept exists. There is no evidence of proof of exploitation at the moment.

Patch

A patch is available. The vulnerability has been fixed in version 1.3.3.4 of the MDTF – Meta Data and Taxonomies Filter plugin for WordPress. Users should update to this version or later to mitigate the risk.

Mitigation

1. Update the MDTF – Meta Data and Taxonomies Filter plugin to version 1.3.3.4 or later immediately. 2. If immediate updating is not possible, consider temporarily disabling the plugin until the update can be applied. 3. Implement strong input validation and sanitization for all user-supplied data, especially in areas where shortcodes are processed. 4. Regularly audit and update all WordPress plugins, themes, and core installations. 5. Implement the principle of least privilege for WordPress user roles and permissions. 6. Use a Web Application Firewall (WAF) to help filter out malicious requests. 7. Monitor WordPress sites for any unusual activity or unauthorized changes.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Timeline

First Article

Feedly found the first article mentioning CVE-2024-8623. See article

Sep 24, 2024 at 2:50 AM / Vulners.com RSS Feed
CVSS Estimate

Feedly estimated the CVSS score as HIGH

Sep 24, 2024 at 2:50 AM
CVE Assignment

NVD published the first details for CVE-2024-8623

Sep 24, 2024 at 3:15 AM
CVSS

A CVSS base score of 7.3 has been assigned.

Sep 24, 2024 at 3:15 AM / nvd
EPSS

EPSS Score was set to: 0.05% (Percentile: 21.3%)

Sep 24, 2024 at 9:33 AM
Detection in Vulnerability Scanners

Detection for the vulnerability has been added to Qualys (152233)

Sep 25, 2024 at 7:53 AM
Static CVE Timeline Graph

Affected Systems

Pluginus/wordpress_meta_data_and_taxonomies_filter
+null more

Patches

plugins.trac.wordpress.org
+null more

Attack Patterns

CAPEC-242: Code Injection
+null more

News

CVE Alert: CVE-2024-8623 - https://www.redpacketsecurity.com/cve_alert_cve-2024-8623/ #OSINT #ThreatIntel #CyberSecurity #cve_2024_8623
CVE Alert: CVE-2024-8623 - redpacketsecurity.com/cve_al… #OSINT #ThreatIntel #CyberSecurity #cve_2024_8623
High - CVE-2024-8623 - The The MDTF – Meta Data and Taxonomies Filter...
The The MDTF – Meta Data and Taxonomies Filter plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.3.3.3. This is due to the software...
CVE Alert: CVE-2024-8623 - https://www. redpacketsecurity.com/cve_aler t_cve-2024-8623/ # OSINT # ThreatIntel # CyberSecurity # cve_2024_8623
CVE-2024-8623
Gravedad 3.1 (CVSS 3.1 Base Score) This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
MDTF – Meta Data and Taxonomies Filter <= 1.3.3.3 - Unauthenticated Arbitrary Shortcode Execution
Realmag777 - HIGH - CVE-2024-8623 The The MDTF – Meta Data and Taxonomies Filter plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.3.3.3. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
See 5 more articles and social media posts

CVSS V3.1

Attack Vector:Network
Attack Complexity:Low
Privileges Required:None
User Interaction:None
Scope:Unchanged
Confidentiality:Low
Integrity:Low
Availability Impact:Low

Categories

Be the first to know about critical vulnerabilities

Collect, analyze, and share vulnerability reports faster using AI