NotFound Fresh Framework Code Injection Vulnerability Allowing Remote Code Execution

A code injection vulnerability has been identified in the NotFound Fresh Framework, specifically in versions through 1.70.0. This vulnerability allows for remote code execution, enabling attackers to execute arbitrary commands on the affected system.

Impact

Exploitation of this vulnerability allows for remote code execution on the affected website, potentially leading to unauthorized access and control over the site.

Remediation

Users are advised to update to a version of Fresh Framework later than 1.70.0. For those using WordPress, Patchstack has issued a virtual patch that automatically mitigates this vulnerability by blocking attacks until an official fix is available.