CVE-2024-8623: MDTF – Meta Data and Taxonomies Filter <= 1.3.3.3 - Unauthenticated Arbitrary Shortcode Execution
First published: Tue Sep 24 2024(Updated: )
The The MDTF – Meta Data and Taxonomies Filter plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.3.3.3. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
Credit: security@wordfence.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Meta Data and Taxonomies Filter by realmag777 | <1.3.3.4 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://www.wordfence.com/threat-intel/vulnerabilities/id/ba584e02-5242-4869-a452-21e6b8995bd8?source=cve
- https://plugins.trac.wordpress.org/browser/wp-meta-data-filter-and-taxonomy-filter/trunk/classes/page.php#L248
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3150646%40wp-meta-data-filter-and-taxonomy-filter&new=3150646%40wp-meta-data-filter-and-taxonomy-filter&sfp_email=&sfph_mail=
Frequently Asked Questions
What is the severity of CVE-2024-8623?
CVE-2024-8623 is considered a critical vulnerability due to its potential for arbitrary shortcode execution.
How do I fix CVE-2024-8623?
To fix CVE-2024-8623, update the MDTF – Meta Data and Taxonomies Filter plugin to version 1.3.3.4 or later.
Which software versions are affected by CVE-2024-8623?
CVE-2024-8623 affects all versions of the MDTF – Meta Data and Taxonomies Filter plugin up to and including 1.3.3.3.
What type of vulnerability is CVE-2024-8623?
CVE-2024-8623 is a vulnerability that allows for arbitrary shortcode execution due to improper value validation.
Is CVE-2024-8623 specific to any WordPress version?
CVE-2024-8623 is not specific to any WordPress version but affects the MDTF plugin regardless of the WordPress core version.
- agent/references
- agent/weakness
- agent/title
- agent/first-publish-date
- agent/type
- agent/description
- agent/severity
- agent/author
- agent/event
- agent/remedy
- agent/last-modified-date
- collector/mitre-cve
- source/MITRE
- collector/epss-latest
- source/FIRST
- agent/epss
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- agent/softwarecombine
- agent/tags
- agent/source
- vendor/pluginus
- canonical/meta data and taxonomies filter by realmag777