CVE-2023-5199

Summary

CVE-2023-5199 is a critical vulnerability affecting the PHP to Page plugin for WordPress versions up to and including 0.3. The vulnerability allows authenticated attackers with subscriber-level permissions or above to exploit Local File Inclusion to achieve Remote Code Execution via the 'php-to-page' shortcode. This means that attackers can include local files and potentially execute malicious code on the server. While subscribers would need to poison log files or install a file, author-level users and above can easily upload files and achieve remote code execution. The base severity rating for this vulnerability is 9.9, indicating a high potential danger for organizations using the affected plugin. It is important for organizations to update their WordPress installations and apply any available patches or security updates provided by the plugin developer to remediate this vulnerability and protect their systems from potential exploitation.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.