Nelio Software Nelio AB Testing WordPress Plugin Code Injection Vulnerability Allowing Remote Code Execution

A code injection vulnerability allowing remote code execution has been identified in the Nelio AB Testing WordPress plugin, affecting versions through 8.2.7. This vulnerability arises from improper control over code generation, which could be exploited to execute malicious commands on the affected website, potentially leading to unauthorized access and full control over the site.

Impact

Exploitation of this vulnerability allows for remote code execution on the affected website, enabling a malicious actor to execute commands and potentially gain backdoor access, leading to full control of the site.

Remediation

Users of the Nelio AB Testing WordPress plugin should update to version 8.2.8 or later. Patchstack users can enable auto-update for vulnerable plugins.