Description (CNA)
The Sneeit Framework plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 8.3 via the sneeit_articles_pagination_callback() function. This is due to the function accepting user input and then passing that through call_user_func(). This makes it possible for unauthenticated attackers to execute code on the server which can be leveraged to inject backdoors or, for example, create new administrative user accounts.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Sneeit / Sneeit Framework | affected 0 through 8.3 |
CWE
CWE-94
References
- https://www.wordfence.com/threat-intel/vulnerabilities/id/b5ed8a39-50b0-4acf-9054-ba389c49f345?source=cve
- https://themeforest.net/item/flat-news-responsive-magazine-wordpress-theme/6000513#item-description__release-notes
ADP enrichment
No English description supplied.
No references supplied.