Skip to content
Sign in
Not rated

CVE-2021-25053 The WP Coder WordPress plugin before 2.5.2 within the wow-company admin menu page allows to include() arbitrary file…

Description

The WP Coder WordPress plugin before 2.5.2 within the wow-company admin menu page allows to include() arbitrary file with PHP extension (as well as with data:// or http:// protocols), thus leading to CSRF RCE.

Affected products and versions

Product Affected versions Fixed in
WP Coder – add custom html, css and js code 2.5 earliest → < 2.5.2 2.5.2

Other CVEs of WP Coder – add custom html, css and js code

The 2 CVEs of WP Coder – add custom html, css and js code →
CVE-2022-2388 The WP Coder WordPress plugin before 2.5.3 does not have CSRF check in place when deleting code created by the plugin,… Not rated
Track this CVE