CyberRota Analysis
AI-GeneratedThe Code Engine plugin for WordPress is susceptible to Remote Code Execution due to inadequate access controls on its code injection feature, affecting all versions up to and including 0.3.5. This vulnerability allows authenticated attackers with Contributor-level access or higher to execute arbitrary code on the server, potentially compromising the entire site. WordPress site administrators using this plugin should prioritize immediate updates to mitigate the risk of exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
The Code Engine plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 0.3.5 via the 'code-engine' shortcode. This is due to the plugin not restricting access to the code injecting functionality of the plugin. This makes it possible for authenticated attackers, with Contributor-level access and above, to execute code on the server.