Description

WordPress Plugin Seo Optimized Images contains malicous code. Exploiting this issue may allow an attacker to create a new administrative user account, thus compromising the affected application, and possibly the webserver or computer. WordPress Plugin Seo Optimized Images version 2.1.2 is affected.

Remediation

Update to plugin version 2.1.4 or latest

References

https://www.wordfence.com/blog/2024/06/3-more-plugins-infected-in-wordpress-org-supply-chain-attack-due-to-compromised-developer-passwords/

https://plugins.trac.wordpress.org/changeset/3109373

Related Vulnerabilities

WordPress Plugin User Submitted Posts Cross-Site Scripting (20151113)

XWiki Cross-Site Request Forgery (CSRF) Vulnerability (CVE-2023-37277)

ownCloud Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') Vulnerability (CVE-2015-3013)

phpMyAdmin Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2017-1000015)

PHP Other Vulnerability (CVE-2006-2660)

Severity

High

Classification

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Tags

Missing Update CWE-506 CVE-2024-6297