CVE-2022-24664
CRITICAL EXPLOITEDPHP Everywhere <= 2.0.3 - Authenticated Remote Code Execution via WordPress Metabox
Title source: llmExploitation Summary
CVE-2022-24664 has been observed exploited in the wild (reported by VulnCheck KEV).
Description
PHP Everywhere <= 2.0.3 included functionality that allowed execution of PHP Code Snippets via WordPress metaboxes, which could be used by any user able to edit posts.
References (1)
Core 1
Core References
Third Party Advisory x_refsource_misc
https://www.wordfence.com/blog/2022/02/critical-vulnerabilities-in-php-everywhere-allow-remote-code-execution/
Scores
CVSS v3
9.9
EPSS
0.0159
EPSS Percentile
72.6%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
no
Technical Impact
total
Details
VulnCheck KEV
2024-07-25
CWE
CWE-94
Status
published
Products (1)
php_everywhere_project/php_everywhere
< 2.0.3
Published
Feb 16, 2022
Tracked Since
Feb 18, 2026