CVE-2023-5201

Deeper analysis

The OpenHook plugin for WordPress, up through version 4.3.0, contains a remote code execution vulnerability (CWE-94) that stems from its handling of the 'php' shortcode. When the shortcode feature is enabled, the plugin passes attacker-supplied input directly to PHP execution functions without adequate sanitization, allowing code to run in the context of the web server.

An authenticated attacker who possesses at least subscriber-level access can supply a malicious [php] shortcode in any post, page, or comment field that accepts shortcodes. Successful exploitation grants the attacker the ability to execute arbitrary PHP on the server, resulting in full confidentiality, integrity, and availability impact across the affected site and potentially other sites hosted on the same server.

The referenced plugin changelog shows that version 4.3.1 revises the shortcode implementation to remove the direct execution path. Site operators are therefore advised to update the OpenHook plugin immediately and to disable the [php] shortcode feature if it is not required. The associated EPSS score has remained low and essentially flat since disclosure, indicating limited observed exploitation interest to date.