Vulnerability Description
The PHP to Page plugin for WordPress is vulnerable Local File Inclusion to Remote Code Execution in versions up to, and including, 0.3 via the 'php-to-page' shortcode. This allows authenticated attackers with subscriber-level permissions or above, to include local file and potentially execute code on the server. While subscribers may need to poison log files or otherwise get a file installed in order to achieve remote code execution, author and above users can upload files by default and achieve remote code execution easily.
CVSS Score
CRITICAL
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Php To Page Project | Php To Page | <= 0.3 |
Related Weaknesses (CWE)
References
- https://plugins.trac.wordpress.org/browser/php-to-page/trunk/php-to-page.php?revExploit
- https://www.wordfence.com/threat-intel/vulnerabilities/id/83e5a0dc-fc51-4565-945Third Party Advisory
- https://plugins.trac.wordpress.org/browser/php-to-page/trunk/php-to-page.php?revExploit
- https://www.wordfence.com/threat-intel/vulnerabilities/id/83e5a0dc-fc51-4565-945Third Party Advisory
FAQ
What is CVE-2023-5199?
CVE-2023-5199 is a vulnerability with a CVSS score of 9.9 (CRITICAL). The PHP to Page plugin for WordPress is vulnerable Local File Inclusion to Remote Code Execution in versions up to, and including, 0.3 via the 'php-to-page' shortcode. This allows authenticated attack...
How severe is CVE-2023-5199?
CVE-2023-5199 has been rated CRITICAL with a CVSS base score of 9.9/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2023-5199?
Check the references section above for vendor advisories and patch information. Affected products include: Php To Page Project Php To Page.