CVE-2022-24663 : Security Advisory and Response

PHP Everywhere <= 2.0.3 included functionality that allowed execution of PHP Code Snippets via WordPress shortcodes, posing a critical risk of remote code execution by authenticated users.

Understanding CVE-2022-24663

This CVE highlights a vulnerability in PHP Everywhere plugin for WordPress, enabling attackers to execute PHP code snippets through WordPress shortcodes.

What is CVE-2022-24663?

CVE-2022-24663 allows any authenticated user to execute PHP code snippets via WordPress shortcodes in PHP Everywhere version 2.0.3 or below, potentially leading to remote code execution.

The Impact of CVE-2022-24663

With a CVSS base score of 9.9 (Critical), this vulnerability has a high impact on confidentiality, integrity, and availability, making systems susceptible to malicious code execution.

Technical Details of CVE-2022-24663

The following technical details outline the vulnerability's description, affected systems, and exploitation mechanism.

Vulnerability Description

PHP Everywhere <= 2.0.3 fails to properly control the generation of code, allowing attackers to perform code injection through PHP code snippets in WordPress shortcodes.

Affected Systems and Versions

The vulnerability affects PHP Everywhere version 2.0.3 and earlier, specifically impacting WordPress platforms where the plugin is installed.

Exploitation Mechanism

Attackers can exploit this vulnerability by crafting and inserting malicious PHP code snippets within WordPress shortcodes, leveraging authenticated user privileges for remote code execution.

Mitigation and Prevention

To secure systems against CVE-2022-24663, immediate steps, long-term security practices, and timely patching are recommended.

Immediate Steps to Take

Disable or remove the PHP Everywhere plugin if not essential.
Implement strong access controls and limit user privileges in WordPress.

Long-Term Security Practices

Regularly update software and plugins to the latest versions.
Conduct security audits and code reviews to identify and mitigate vulnerabilities.

Patching and Updates

Apply the latest patches and security updates provided by the plugin vendor to address CVE-2022-24663 and enhance overall system security.