Funnelforms LLC FunnelFormsPro Code Injection Vulnerability Allowing Remote Code Execution

A code injection vulnerability allowing remote code execution has been identified in the FunnelFormsPro WordPress plugin, affecting versions through 3.8.1. This vulnerability arises from improper control over code generation, which could enable malicious actors to execute arbitrary commands on the affected website, potentially leading to full control over the site.

Impact

Exploitation of this vulnerability allows for remote code execution on the affected website, enabling attackers to execute commands and possibly gain backdoor access for full control of the site.

Remediation

Users are advised to update the FunnelFormsPro plugin to the latest version. If an update cannot be applied, consult with your hosting provider or web developer for assistance.