CVE-2023-4994 | The Allow PHP in Posts and Pages plugin for WordPress is vul… | CVSS 9.9 CRITICAL

Description

The Allow PHP in Posts and Pages plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 3.0.4 via the 'php' shortcode. This allows authenticated attackers with subscriber-level permissions or above, to execute code on the server.

Metadata

CVE ID: CVE-2023-4994
State: PUBLISHED
Assigner: Wordfence
Reserved: 2023-09-15 12:35 UTC
Published: 2023-09-16 01:52 UTC
Last updated: 2026-04-08 16:47 UTC
Primary CWE: CWE-94
CWE-94 Improper Control of Generation of Code ('Code Injecti…
Vendor / Product: hit-reach / Allow PHP in Posts and Pages
Sources: cve.org · NVD

Severity & Metrics

9.9 CRITICAL CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

SSVC — CISA Coordinator

Exploitation: none
Automatable: no
Tech. Impact: total

Affected products (1)

Vendor	Product	Platform	Versions
hit-reach	Allow PHP in Posts and Pages	—	0 ≤ 3.0.4

Weakness (CWE)

CWE	Source	Description
CWE-94	cna	CWE-94 Improper Control of Generation of Code ('Code Injection')

CVSS scores (1)

Score	Severity	Version	Source	Vector
9.9	CRITICAL	3.1	cna	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

References (2)