Vulnerability · Published May 23, 2024 · Assigned by Wordfence
CVE-2024-4662Oxygen Builder <= 4.8.2 - Authenticated (Contributor+) Remote Code Execution
High 8.8
In plain English
A high-severity code injection in Oxygen Builder from Oxygen Builder. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 58% of all known vulnerabilities).
Official description
The Oxygen Builder plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.8.2 via post metadata. This is due to the plugin storing custom data in post metadata without an underscore prefix. This makes it possible for lower privileged users, such as contributors, to inject arbitrary PHP code via the WordPress user interface and gain elevated privileges.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Oxygen Builder | Oxygen Builder | 0 – through 4.8.2 |
Weakness: CWE-94 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H