CVE-2024-4662

The Oxygen Builder plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.8.2 via post metadata. This is due to the plugin storing custom data in post metadata without an underscore prefix. This makes it possible for lower privileged users, such as contributors, to inject arbitrary PHP code via the WordPress user interface and gain elevated privileges.

• CWE-94

• https://oxygenbuilder.com/oxygen-4-8-3-now-available-security-update/
• https://www.wordfence.com/threat-intel/vulnerabilities/id/8706c3f6-64e0-440e-a802-5c80d9cc3643?source=cve
• https://oxygenbuilder.com/oxygen-4-8-3-now-available-security-update/
• https://www.wordfence.com/threat-intel/vulnerabilities/id/8706c3f6-64e0-440e-a802-5c80d9cc3643?source=cve

Published

May 23, 2024

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-46607Incorrect access control in IceCMS v3.4.7 and before allows …7.6
• CVE-2024-46609An access control issue in the CheckVip function in UserCont…7.5
• CVE-2024-4661The WP Reset plugin for WordPress is vulnerable to unauthori…4.3
• CVE-2024-46610An access control issue in IceCMS v3.4.7 and before allows a…7.5
• CVE-2024-46612IceCMS v3.4.7 and before was discovered to contain a hardcod…9.8
• CVE-2024-46613WeeChat before 4.4.2 has an integer overflow and resultant b…9.8
• CVE-2024-46622An Escalation of Privilege security vulnerability was found …9.8
• CVE-2024-46624An issue in InfoDom Performa 365 v4.0.1 allows authenticated…8.8
• CVE-2024-46625An authenticated arbitrary file upload vulnerability in the …8.8
• CVE-2024-46626OS4ED openSIS-Classic v9.1 was discovered to contain a SQL i…8.8
• CVE-2024-46627Incorrect access control in BECN DATAGERRY v2.2 allows attac…9.1
• CVE-2024-46628Tenda G3 Router firmware v15.03.05.05 was discovered to cont…9.8