CVE-2023-4994
Allow PHP in Posts and Pages <= 3.0.4 - Authenticated (Subscriber+) Remote Code Execution via Shortcode
- State
- Published
- Severity
- 9.9 Critical
- Published
- Sep 16, 2023
- Updated
- Apr 8, 2026
- Reserved
- Sep 15, 2023
Description
The Allow PHP in Posts and Pages plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 3.0.4 via the 'php' shortcode. This allows authenticated attackers with subscriber-level permissions or above, to execute code on the server.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 9.9 Critical | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H | Wordfence |
Weaknesses
- CWE-94 Improper Control of Generation of Code ('Code Injection')
Affected Products
| Product | Versions |
|---|---|
Allow PHP in Posts and Pageshit-reach |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.