If you run a WordPress-powered site, then you must get to know it!
A high-severity cross-site request forgery (CSRF) to Remote Code Execution (RCE) vulnerability, tracked as CVE-2020-8417, has been discovered in a popular WordPress plugin, potentially opening up over 200K websites to complete takeover, information disclosure, and more.
The plugin in question is Code Snippets, which offers users an intuitive graphical user interface (similar to the Plugins menu) to add, run and manage PHP code snippets to their WordPress sites in order to customize or extend the functionality of the website, all without diving into the theme’s underlying code.
No comments:
Post a Comment