CVE-2023-5201

The OpenHook plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 4.3.0 via the 'php' shortcode. This allows authenticated attackers with subscriber-level permissions or above, to execute code on the server. This requires the [php] shortcode setting to be enabled on the vulnerable site.

• CWE-94

• https://plugins.trac.wordpress.org/browser/thesis-openhook/tags/4.3.0/inc/shortcodes.php#L28Third Party Advisory
• https://plugins.trac.wordpress.org/browser/thesis-openhook/tags/4.3.1/inc/shortcodes.php?rev=2972840#L24Third Party Advisory
• https://www.wordfence.com/threat-intel/vulnerabilities/id/37b9ed0e-5af2-47c1-b2da-8d103e4c31bf?source=cveThird Party Advisory
• https://plugins.trac.wordpress.org/browser/thesis-openhook/tags/4.3.0/inc/shortcodes.php#L28Third Party Advisory
• https://plugins.trac.wordpress.org/browser/thesis-openhook/tags/4.3.1/inc/shortcodes.php?rev=2972840#L24Third Party Advisory
• https://www.wordfence.com/threat-intel/vulnerabilities/id/37b9ed0e-5af2-47c1-b2da-8d103e4c31bf?source=cveThird Party Advisory

Published

Sep 30, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-51982CrateDB 5.5.1 is contains an authentication bypass vulnerabi…9.8
• CVE-2023-51984D-Link DIR-822+ V1.0.2 was found to contain a command inject…9.8
• CVE-2023-51987D-Link DIR-822+ V1.0.2 contains a login bypass in the HNAP1 …9.8
• CVE-2023-51989Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2023-5199The PHP to Page plugin for WordPress is vulnerable Local Fil…8.8
• CVE-2023-5200The flowpaper plugin for WordPress is vulnerable to Stored C…5.4
• CVE-2023-52026TOTOlink EX1800T V9.1.0cu.2112_B20220316 was discovered to c…9.8
• CVE-2023-52027TOTOlink A3700R v9.1.2u.5822_B20200513 was discovered to con…9.8
• CVE-2023-52028TOTOlink A3700R v9.1.2u.5822_B20200513 was discovered to con…9.8
• CVE-2023-52029TOTOlink A3700R v9.1.2u.5822_B20200513 was discovered to con…9.8
• CVE-2023-5203The WP Sessions Time Monitoring Full Automatic WordPress plu…7.5
• CVE-2023-52030TOTOlink A3700R v9.1.2u.5822_B20200513 was discovered to con…9.8