Vulnerability CVE-2020-11548
Published: 2020-04-05

Description:
The Search Meter plugin through 2.13.2 for WordPress allows user input introduced in the search bar to be any formula. The attacker could achieve remote code execution via CSV injection if a wp-admin/index.php?page=search-meter Export is performed.

Type:

CWE-20

 (Improper Input Validation)

CVSS2 => (AV:N/AC:L/Au:N/C:P/I:P/A:P)

CVSS Base Score
Impact Subscore
Exploitability Subscore
7.5/10
6.4/10
10/10
Exploit range
Attack complexity
Authentication
Remote
Low
No required
Confidentiality impact
Integrity impact
Availability impact
Partial
Partial
Partial
Affected software
Search meter project -> Search meter 

 References:
https://wordpress.org/plugins/search-meter/#developers
https://www.exploit-db.com/exploits/48197
Copyright 2024, cxsecurity.com

 

Back to Top