Description

WordPress Plugin Ad Invalid Click Protector (AICP) contains malicous code. Exploiting this issue may allow an attacker to create a new administrative user account, thus compromising the affected application, and possibly the webserver or computer. WordPress Plugin Ad Invalid Click Protector (AICP) version 1.2.9 is affected.

Remediation

Update to plugin version 1.2.11 or latest

References

https://www.wordfence.com/blog/2024/06/3-more-plugins-infected-in-wordpress-org-supply-chain-attack-due-to-compromised-developer-passwords/

https://plugins.trac.wordpress.org/changeset/3109320

Related Vulnerabilities

WordPress Plugin Quiz and Survey Master (QSM)-Easy Quiz and Survey Maker Cross-Site Request Forgery (8.0.7)

Joomla Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Vulnerability (CVE-2008-6852)

WordPress Plugin Image Export Arbitrary File Download (1.1.0)

MySQL CVE-2018-2818 Vulnerability (CVE-2018-2818)

WordPress Plugin Email Subscribers by Icegram Express-Email Marketing, Newsletters, Automation for WordPress & WooCommerce Cross-Site Scripting (3.2.5)

Severity

High

Classification

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Tags

Missing Update CWE-506 CVE-2024-6297