PT-2026-99411

Name of the Vulnerable Software and Affected Versions Groups – Memberships and Access Control versions prior to 4.6.1 Description An issue exists where the groups join function determines group-join eligibility based on the author capabilities of the ambient post via the global $post-post author...

Improper Input Validation

Overview johnpbloch/wordpress-core is a web software you can use to create a website or blog. Affected versions of this package are vulnerable to Improper Input Validation due to insufficient input validation in the parsemediashortcode AJAX function. An attacker can manipulate the shortcode outpu...

PHP Everywhere wp_ajax_parse_media_shortcode() Code Execution

The vulnerability of the wpajaxparsemediashortcode function in the PHP plugin for implementing PHP Everywhere is related to incorrect code generation. Exploiting this vulnerability could allow an attacker to execute arbitrary code...

PHP Everywhere 2.0.3 Remote Code Execution

On January 4, 2022, the Wordfence Threat Intelligence team began the responsible disclosure process for several Remote Code Execution vulnerabilities in PHP Everywhere, a WordPress plugin installed on over 30,000 websites. One of these vulnerabilities allowed any authenticated user of any level,...

PT-2022-1624

Name of the Vulnerable Software and Affected Versions PHP Everywhere versions 2.0.3 and earlier Description The issue is related to the incorrect management of code generation in the wp ajax parse media shortcode function of the PHP Everywhere plugin, allowing for the execution of PHP code snippe...