CVSS 3.1 Score 9.9 of 10 (high)


Published Oct 30, 2023
Updated: Nov 13, 2023
CWE ID 552


CVE-2023-5199 is a critical vulnerability affecting the PHP to Page plugin for WordPress versions up to and including 0.3. The vulnerability allows authenticated attackers with subscriber-level permissions or above to exploit Local File Inclusion to achieve Remote Code Execution via the 'php-to-page' shortcode. This means that attackers can include local files and potentially execute malicious code on the server. While subscribers would need to poison log files or install a file, author-level users and above can easily upload files and achieve remote code execution. The base severity rating for this vulnerability is 9.9, indicating a high potential danger for organizations using the affected plugin. It is important for organizations to update their WordPress installations and apply any available patches or security updates provided by the plugin developer to remediate this vulnerability and protect their systems from potential exploitation.

Explore Beyond the CVE Basics with Recorded Future's Vulnerability Intelligence

Note: This is just a basic overview providing quick insights into CVE-2023-5199 information. Gain full access to comprehensive CVE data, risk scores, prioritization, and mitigation data through Recorded Future's Vulnerability Intelligence:
  • Prioritize with Risk-Based Scoring
  • Explore the Extensive Vulnerability Database
  • Receive Early Alerts on Emerging CVEs
  • Focus on Critical Exploitable Vulnerabilities
  • Streamline Remediation with Integration Options