CVE-2024-6330

GEO my WordPress < 4.4.0.2 - Unauthenticated RCE via LFI

CVSS 9.8 CRITICALEPSS 2.1%

Vexday Risk Score

48Attention

SSVC decision (CISA)

Attend

PoC available → attend closely

CVSS 9.8EPSS 2.1%KEV nãoPoC públicaNuclei —Metasploit —Patch —

Lifecycle

19 Aug 2024Published on NVD

20 Nov 2024Public PoC

Recommendation: Plan a near-term fix — a public PoC already exists.

The GEO my WP WordPress plugin before 4.5.0.2 does not prevent unauthenticated attackers from including arbitrary files in PHP's execution context, which leads to Remote Code Execution.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

Unknown · GEO my WP

public PoCs found — 2

githubgithub.com/RandomRobbieBF/CVE-2024-6330★ 0 cve_referencewpscan.com/vulnerability/95b532e0-1ffb-421e-b9c0-de03f89491d7/unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

https://wpscan.com/vulnerability/95b532e0-1ffb-421e-b9c0-de03f89491d7/