CVE-2024-9772
Improper Control of Generation of Code ('Code Injection') (CWE-94)
Published: Oct 26, 2024 / Updated: 24d ago
010
CVSS 7.3EPSS 0.05%High
CVE info copied to clipboard
The The Uix Shortcodes – Compatible with Gutenberg plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.9.9. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Timeline
First Article
Feedly found the first article mentioning CVE-2024-9772. See article
Oct 26, 2024 at 9:39 AM / CVE
CVSS Estimate
Feedly estimated the CVSS score as HIGH
Oct 26, 2024 at 9:41 AM
CVE Assignment
NVD published the first details for CVE-2024-9772
Oct 26, 2024 at 10:15 AM
CVSS
A CVSS base score of 7.3 has been assigned.
Oct 26, 2024 at 10:20 AM / nvd
EPSS
EPSS Score was set to: 0.05% (Percentile: 21.5%)
Oct 27, 2024 at 11:57 AM
Affected Systems
Wordpress/gutenberg
+null more
Attack Patterns
CAPEC-242: Code Injection
+null more
News
Wordfence Intelligence Weekly WordPress Vulnerability Report (October 21, 2024 to October 27, 2024)
The team rolled out enhanced protection via firewall rules for the following vulnerabilities in real-time to our Premium, Care, and Response customers last week: WordPress Plugins with Reported Vulnerabilities Last Week
Update Sun Oct 27 14:34:00 UTC 2024
Update Sun Oct 27 14:34:00 UTC 2024
CVE Alert: CVE-2024-9772 - https://www.redpacketsecurity.com/cve_alert_cve-2024-9772/ #OSINT #ThreatIntel #CyberSecurity #cve_2024_9772
CVE Alert: CVE-2024-9772 - redpacketsecurity.com/cve_al… #OSINT #ThreatIntel #CyberSecurity #cve_2024_9772
CVE Alert: CVE-2024-9772
This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
CVE-2024-9772
High Severity Description The The Uix Shortcodes – Compatible with Gutenberg plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.9.9. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes. Read more at https://www.tenable.com/cve/CVE-2024-9772
See 8 more articles and social media posts