Vulnerability · Published Dec 15, 2025 · Assigned by VulnCheck
CVE-2023-53872Wp2Fac 1.0 OS Command Injection via send.php Endpoint
Critical 9.3
In plain English
A critical-severity OS command injection in Wp2Fac from wp2fac. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.1% (higher than 66% of all known vulnerabilities).
Severity (CVSS 4.0)9.3Critical
Exploit odds (30 days)1.1%top 33.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Wp2Fac 1.0 contains an OS command injection vulnerability in the send.php endpoint that allows remote attackers to execute arbitrary system commands. Attackers can inject shell commands through the 'numara' parameter by appending shell commands with '&' operators to execute malicious code.
Affected products (as reported)
Weakness: CWE-78 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
References
- ExploitDB-51717 exploit
- wp2fac GitHub Repository product
- VulnCheck Advisory: Wp2Fac 1.0 OS Command Injection via send.php Endpoint third-party-advisory