CVE-2023-6999: Command Injection
First published: Tue Apr 09 2024(Updated: )
The Pods – Custom Content Types and Fields plugin for WordPress is vulnerable to Remote Code Exxecution via shortcode in all versions up to, and including, 3.0.10 (with the exception of 2.7.31.2, 2.8.23.2, 2.9.19.2). This makes it possible for authenticated attackers, with contributor level access or higher, to execute code on the server.
Credit: security@wordfence.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Pods Custom Content Types and Fields | <=3.0.10 | |
| Pods Foundation | <2.7.31.2 | |
| Pods Foundation | >=2.8<2.8.23.2 | |
| Pods Foundation | >=2.9<2.9.19.2 | |
| Pods Foundation | >=3.0.0<3.0.10.2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://www.wordfence.com/threat-intel/vulnerabilities/id/d9108d5f-7b8b-478d-ba9d-f895bdb7dbf2?source=cve
- https://plugins.trac.wordpress.org/browser/pods/trunk/classes/PodsView.php#L750
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3039486%40pods%2Ftrunk&old=3039467%40pods%2Ftrunk&sfp_email=&sfph_mail=
Frequently Asked Questions
What is the severity of CVE-2023-6999?
CVE-2023-6999 is classified as a critical vulnerability due to its potential for remote code execution.
How do I fix CVE-2023-6999?
To fix CVE-2023-6999, update the Pods – Custom Content Types and Fields plugin to version 3.0.11 or later.
Who is affected by CVE-2023-6999?
CVE-2023-6999 affects all versions of the Pods – Custom Content Types and Fields plugin up to and including 3.0.10.
What type of attack does CVE-2023-6999 enable?
CVE-2023-6999 enables authenticated attackers to execute arbitrary code via a vulnerable shortcode.
What are the credentials needed to exploit CVE-2023-6999?
An attacker needs contributor level access to exploit CVE-2023-6999.
- agent/weakness
- agent/references
- agent/first-publish-date
- agent/type
- agent/description
- agent/severity
- agent/author
- agent/event
- collector/mitre-cve
- source/MITRE
- agent/source
- agent/last-modified-date
- agent/softwarecombine
- agent/tags
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- collector/nvd-api
- source/NVD
- vendor/pods
- canonical/pods custom content types and fields
- vendor/podsfoundation
- canonical/pods foundation
- version/pods foundation/2.8
- version/pods foundation/2.9
- version/pods foundation/3.0.0