Vulnerability · Published Dec 29, 2023 · Assigned by Patchstack
CVE-2023-47840WordPress Qode Essential Addons Plugin <= 1.5.2 is vulnerable to Remote Code Execution (RCE)
Critical 9.9
In plain English
A critical-severity code injection in Qode Essential Addons from Qode Interactive. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.4% (higher than 73% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.
Severity (CVSS 3.1)9.9Critical
Exploit odds (30 days)1.4%top 27.3% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack tooling1Public PoC
Official description
Improper Control of Generation of Code ('Code Injection') vulnerability in Qode Interactive Qode Essential Addons.This issue affects Qode Essential Addons: from n/a through 1.5.2.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Qode Interactive | Qode Essential Addons | n/a – through 1.5.2 |
Weakness: CWE-94 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H