WPFactory Custom CSS, JS & PHP Cross-Site Request Forgery Vulnerability Allowing Remote Code Inclusion

A Cross-Site Request Forgery (CSRF) vulnerability has been identified in the WPFactory Custom CSS, JS & PHP plugin, affecting versions through 2.4.1. This vulnerability allows for Remote Code Inclusion, where an attacker could potentially execute arbitrary code on the server by exploiting the CSRF flaw.

Impact

Exploitation of this vulnerability could lead to Remote Code Execution on the server where the vulnerable WordPress site is hosted.

Remediation

Users of the WPFactory Custom CSS, JS & PHP plugin should update to version 2.4.2 or later to address this vulnerability. Patchstack users can enable auto-update for vulnerable plugins.