CVE-2024-7094
CVSS 3.1 Score 9.8 of 10 (high)
Details
Summary
CVE-2024-7094 is a critical vulnerability affecting the JS Help Desk plugin for WordPress. The issue allows unauthenticated attackers to execute arbitrary PHP code on the server by injecting malicious code into the 'storeTheme' function. This vulnerability arises due to insufficient sanitization of user-supplied input and missing capability checks. Previously, version 2.8.6 addressed the code injection issue but failed to include essential authorization and cross-site request forgery protections. A fully patched version 2.8.7 is now available to mitigate this risk.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.