CVE-2024-13890
Last modified
CVE-2024-13890 is a high-severity vulnerability rated 7.2/10 on the CVSS scale. The Allow PHP Execute plugin for WordPress is vulnerable to PHP Code Injection in all versions up to, and including, 1.0. This is due to allowing PHP code to be entered by all users for whom unfiltered HTML is allowed. EPSS estimates a 0.43% chance of exploitation in the next 30 days.
Description
The Allow PHP Execute plugin for WordPress is vulnerable to PHP Code Injection in all versions up to, and including, 1.0. This is due to allowing PHP code to be entered by all users for whom unfiltered HTML is allowed. This makes it possible for authenticated attackers, with Editor-level access and above, to inject PHP code into posts and pages.
Metrics
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Sksdev | Allow Php Execute | 1.0 |
References
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2024-13890?
How severe is CVE-2024-13890?
How do I fix CVE-2024-13890?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2024
- CVE-2024-13884The Limit Bio WordPress plugin through 1.0 does not sanitise…7.1
- CVE-2024-13885The WP e-Customers Beta WordPress plugin through 0.0.1 does …7.1
- CVE-2024-13887The Business Directory Plugin – Easy Listing Directories for…5.3
- CVE-2024-13888The WPMobile.App plugin for WordPress is vulnerable to Open …6.1
- CVE-2024-13889The WordPress Importer plugin for WordPress is vulnerable to…7.2
- CVE-2024-1389The Paid Membership Subscriptions – Effortless Memberships, …5.3
- CVE-2024-13891The Schedule WordPress plugin through 1.0.0 does not sanitis…7.1
- CVE-2024-13892Smartwares cameras CIP-37210AT and C724IP, as well as others…7.7
- CVE-2024-13893Smartwares cameras CIP-37210AT and C724IP, as well as others…7.5
- CVE-2024-13894Smartwares cameras CIP-37210AT and C724IP, as well as others…5.9
- CVE-2024-13895The The Code Snippets CPT plugin for WordPress is vulnerable…6.3
- CVE-2024-13896The WP-GeSHi-Highlight — rock-solid syntax highlighting for …6.5
Are you affected by CVE-2024-13890?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST