CVE-2024-28850
CVSS 3.1 Score 8.1 of 10 (high)
Details
Summary
CVE-2024-28850 affects WP Crontrol, a plugin used to manage cron events on WordPress sites. The vulnerability lies in the plugin's feature that allows administrative users to create and execute PHP code as part of cron events. While there is no inherent flaw in this feature, it becomes exploitable if an attacker manages to exploit a separate SQL injection or similar vulnerability to run malicious code in the site's database. This could potentially lead to Remote Code Execution (RCE). If the site meets certain preconditions, such as a vulnerable SQL injection in plugins, themes, or WordPress core, a compromised database, or a way to trigger arbitrary actions, filters, or functions, the vulnerability could be exploited. To mitigate this risk, WP Crontrol version 1.16.2 includes a new feature that prevents tampering of the code in PHP cron events.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.
Advisories, Assessments, and Mitigations
Prioritize, Pinpoint, and Act to Prevent Vulnerability Exploits with Recorded Future
- Gain complete coverage of your cyber, third party, and physical attack surface
- Proactively mitigate threats before they turn into costly attacks
- Make fast, effective, data-driven decisions