MailChimp Subscribe Form, Optin Builder, PopUp Builder, Form Builder < 1.2 - Remote Code Execution
2015-04-21 00:00
woodspeedStrategic Overview
StatusPatched in 1.2
Affected Version
< 1.2CVSS8.8High
CVE
N/AVulnerability Overview
The MailChimp Subscribe Form, Optin Builder, PopUp Builder, Form Builder theme for WordPress is vulnerable to Remote Code Execution in versions before 1.2 via the email field. This allows authenticated attackers to execute code on the server.
Technical Analysis
REMEDIATION: Update to version 1.2, or a newer patched version --- IDENTIFIER: CWE-94 (Improper Control of Generation of Code ('Code Injection')) The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
External References
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C