Dynamics 365 Integration WordPress Plugin Twig Server-Side Template Injection Vulnerability Allowing Remote Code Execution

A vulnerability allowing remote code execution and arbitrary file read has been identified in the Dynamics 365 Integration plugin for WordPress, affecting all versions through 1.3.23. The issue arises from Twig server-side template injection, caused by inadequate input validation and sanitization in the render function. This vulnerability enables authenticated attackers with Contributor-level access and above to execute code on the server.

Impact

Exploitation of this vulnerability allows for remote code execution on the server where the affected WordPress site is hosted.

Remediation

Users are advised to update the Dynamics 365 Integration plugin to version 1.3.24 or a newer patched version.