CVEvulnerability
CVE-2023-6999
8.8 HIGH
Official page ↗
- Status
- Modified
- Published
- 2024-04-09
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 8.8 HIGH — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Weaknesses
- CWE-77
Description
The Pods – Custom Content Types and Fields plugin for WordPress is vulnerable to Remote Code Exxecution via shortcode in all versions up to, and including, 3.0.10 (with the exception of 2.7.31.2, 2.8.23.2, 2.9.19.2). This makes it possible for authenticated attackers, with contributor level access or higher, to execute code on the server.
Affected configurations
• podsfoundation pods (< 2.7.31.2)
• podsfoundation pods (>= 2.8 < 2.8.23.2)
• podsfoundation pods (>= 2.9 < 2.9.19.2)
• podsfoundation pods (>= 3.0.0 < 3.0.10.2)
Related
Weakness · CWE (1)
- CWE-77 Improper Neutralization of Special Elements used in a Command weakness
References
- https://plugins.trac.wordpress.org/browser/pods/trunk/classes/PodsView.php#L750 Product
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3039486%40pods%2Ftrunk&old=3039467%40pods%2Ftrunk&sfp_email=&sfph_mail= Product
- https://www.wordfence.com/threat-intel/vulnerabilities/id/d9108d5f-7b8b-478d-ba9d-f895bdb7dbf2?source=cve Third Party Advisory
- https://plugins.trac.wordpress.org/browser/pods/trunk/classes/PodsView.php#L750 Product
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3039486%40pods%2Ftrunk&old=3039467%40pods%2Ftrunk&sfp_email=&sfph_mail= Product
- https://www.wordfence.com/threat-intel/vulnerabilities/id/d9108d5f-7b8b-478d-ba9d-f895bdb7dbf2?source=cve Third Party Advisory