WordPress Plugin Vulnerabilities

WP Latest Posts < 5.0.8 - Authenticated (Subscriber+) Arbitrary Shortcode Execution

Description

The WP Latest Posts plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 5.0.7. This is due to the plugin allowing users to execute an action that does not properly validate a user-supplied value prior to using that value in a call to do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.

Affects Plugins

Plugin icon
wp-latest-posts
Fixed in 5.0.8

References

CVE
CVE-2024-4135
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/57d90ba7-b655-4655-981c-548ff96c3bb7

Classification

Type
RCE
OWASP top 10
A1: Injection
CWE
CWE-94
CVSS
5.4 (medium)

Miscellaneous

Original Researcher
stealthcopter
Verified
No
WPVDB ID
2a249cdb-cbd8-418d-89d8-1d72bd54577e

Timeline

Publicly Published
2024-05-07 (about 2 years ago)
Added
2024-05-07 (about 2 years ago)
Last Updated
2024-05-07 (about 2 years ago)

Other

Published
Title
Published
2026-03-02
Title
tagDiv Composer < 5.4.5 - Unauthenticated Arbitrary Shortcode Execution
Published
2021-06-07
Title
Recently < 3.0.5 - Authenticated Code Injection
Published
2015-05-06
Title
eShop <= 6.3.11 - Remote Code Execution
Published
2025-05-07
Title
Wolmart | Multi-Vendor Marketplace WooCommerce Theme < 1.8.12 - Unauthenticated Arbitrary Shortcode Execution in wolmart_loadmore
Published
2026-10-09
Title
Fastcache by Host.it < 1.7.5 - Authenticated (Administrator+) Code Injection via .htaccess Directive Injection via 'cache_cookie_exclude' Setting