CVE-2023-5199

The PHP to Page plugin for WordPress is vulnerable Local File Inclusion to Remote Code Execution in versions up to, and including, 0.3 via the 'php-to-page' shortcode. This allows authenticated attackers with subscriber-level permissions or above, to include local file and potentially execute code on the server. While subscribers may need to poison log files or otherwise get a file installed in order to achieve remote code execution, author and above users can upload files by default and achieve remote code execution easily.

• CWE-98
• CWE-552

• https://plugins.trac.wordpress.org/browser/php-to-page/trunk/php-to-page.php?rev=441028#L22Exploit
• https://www.wordfence.com/threat-intel/vulnerabilities/id/83e5a0dc-fc51-4565-945f-190cf9175874?source=cveThird Party Advisory
• https://plugins.trac.wordpress.org/browser/php-to-page/trunk/php-to-page.php?rev=441028#L22Exploit
• https://www.wordfence.com/threat-intel/vulnerabilities/id/83e5a0dc-fc51-4565-945f-190cf9175874?source=cveThird Party Advisory

Published

Oct 30, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-51978In PHPGurukul Art Gallery Management System v1.1, "Update Ar…6.5
• CVE-2023-5198An issue has been discovered in GitLab affecting all version…4.3
• CVE-2023-51982CrateDB 5.5.1 is contains an authentication bypass vulnerabi…9.8
• CVE-2023-51984D-Link DIR-822+ V1.0.2 was found to contain a command inject…9.8
• CVE-2023-51987D-Link DIR-822+ V1.0.2 contains a login bypass in the HNAP1 …9.8
• CVE-2023-51989Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2023-5200The flowpaper plugin for WordPress is vulnerable to Stored C…5.4
• CVE-2023-5201The OpenHook plugin for WordPress is vulnerable to Remote Co…8.8
• CVE-2023-52026TOTOlink EX1800T V9.1.0cu.2112_B20220316 was discovered to c…9.8
• CVE-2023-52027TOTOlink A3700R v9.1.2u.5822_B20200513 was discovered to con…9.8
• CVE-2023-52028TOTOlink A3700R v9.1.2u.5822_B20200513 was discovered to con…9.8
• CVE-2023-52029TOTOlink A3700R v9.1.2u.5822_B20200513 was discovered to con…9.8