CVE-2011-10033

🗓️ 15 Oct 2025 01:23:46Reported by VulnCheckType

cve🔗 web.nvd.nist.gov👁 33 Views🌐 WEB

WordPress is-human plugin 1.4.2 has eval injection via type, enabling remote code execution.

Reporter	Title	Published	Views	Family All 12
attackerkb	CVE-2011-10033	15 Oct 202501:23	–	attackerkb
Circl	CVE-2011-10033	16 Oct 202521:02	–	circl
CNNVD	WordPress plugin is-human 安全漏洞	15 Oct 202500:00	–	cnnvd
Cvelist	CVE-2011-10033 WordPress Plugin is-human <= v1.4.2 Eval Injection RCE	15 Oct 202501:23	–	cvelist
EUVD	EUVD-2011-5263	15 Oct 202501:23	–	euvd
NVD	CVE-2011-10033	15 Oct 202502:15	–	nvd
OpenVAS	WordPress Is-human Plugin <= v1.4.2 'passthru()' Function RCE Vulnerability - Active Check	26 May 201100:00	–	openvas
Positive Technologies	PT-2025-42214	15 Oct 202500:00	–	ptsecurity
Rapid7 Vulnerability Database (full)	CVE-2011-10033: Improper Neutralization of Directives in Dynamically Evaluated Code	15 Oct 202500:00	–	rapid7
RedhatCVE	CVE-2011-10033	16 Oct 202501:41	–	redhatcve

Vulners

CNA

Node

is-human_wordpress_plugin is-human_wordpress_pluginRange0–1.4.2

[
  {
    "defaultStatus": "unaffected",
    "modules": [
      "/is-human/engine.php"
    ],
    "product": "is-human WordPress Plugin",
    "vendor": "is-human WordPress Plugin",
    "versions": [
      {
        "lessThanOrEqual": "1.4.2",
        "status": "affected",
        "version": "0",
        "versionType": "semver"
      }
    ]
  }
]

Source	Link
exploit-db	www.exploit-db.com/exploits/17299
trustwave	www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/honeypot-alert-more-wordpress-is_human-plugin-remote-command-injection-attack-detected/
vulncheck	www.vulncheck.com/advisories/wordpress-plugin-is-human-eval-injection-rce
wordpress	www.wordpress.org/plugins/is-human/
web	www.web.archive.org/web/20120115212202/http://blog.spiderlabs.com/2012/01/honeypot-alert-is-human-wordpress-plugin-remote-command-execution-attack-detected.html

Parameter	Position	Path	Description	CWE
type	query param	/is-human/engine.php	Eval injection vulnerability: unsafe eval() on user-controlled input via the type parameter when action=log-reset, allowing arbitrary code execution.	CWE-95
action	query param	/is-human/engine.php	Eval injection vulnerability: unsafe eval() on user-controlled input via the type parameter when action=log-reset, allowing arbitrary code execution.	CWE-95

16 Jun 2026 23:28Current

6.2Medium risk

Vulners AI Score6.2

CVSS 49.3

EPSS0.00478

SSVC