CVE-2018-19207

EPSS 87.3%◆ VulnCheck KEV

Vexday Risk Score

82Fix now

SSVC decision (CISA)

Act

Exploitation + impact → act immediately

Exploit maturity

Functional exploit

Automatable exploit available (Nuclei/Metasploit).

CVSS —EPSS 87.3%KEV nãoPoC públicaNuclei simMetasploit simPatch —

Lifecycle

08 Nov 2018Metasploit module available

12 Nov 2018Published on NVD

27 Nov 2018Public PoC

Weaponization speed

14 daysto first PoC

Recommendation: Patch as soon as possible — active exploitation confirmed.

The Van Ons WP GDPR Compliance (aka wp-gdpr-compliance) plugin before 1.4.3 for WordPress allows remote attackers to execute arbitrary code because $wpdb->prepare() input is mishandled, as exploited in the wild in November 2018.

Affected products

n/a · n/a

public PoCs found — 2

vulncheckvulncheck.com/xdb/36d1a44178caunverified vulncheckvulncheck.com/xdb/ba7b7f4736fbunverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

References

https://wordpress.org/plugins/wp-gdpr-compliance/#developers https://wpvulndb.com/vulnerabilities/9144 https://www.wordfence.com/blog/2018/11/trends-following-vulnerability-in-wp-gdpr-compliance-plugin/http://www.securityfocus.com/bid/105921