Allow PHP Execute WordPress Plugin PHP Code Injection Vulnerability

A PHP code injection vulnerability exists in the Allow PHP Execute plugin for WordPress, affecting all versions through 1.0. The vulnerability arises because the plugin allows PHP code to be submitted by users with unfiltered HTML privileges. This enables authenticated attackers with Editor-level access or higher to inject PHP code into posts and pages.

Impact

Exploitation allows for PHP code injection, which could lead to arbitrary code execution on the server.

Remediation

No known patch is available. It is recommended to uninstall the affected plugin and find a replacement.