CVE-2023-5815

Deeper analysis

The News & Blog Designer Pack WordPress plugin is affected by a remote code execution vulnerability via local file inclusion in all versions through 3.4.1. The flaw resides in the bdp_get_more_post function, which is exposed through a nopriv AJAX hook; it unsafely applies extract() to values supplied in the POST body and then passes attacker-controlled input directly to include(), enabling arbitrary PHP file inclusion.

Unauthenticated remote attackers can exploit the issue over the network by submitting crafted AJAX requests that cause the server to load and execute chosen PHP files. On Docker deployments with writable web roots, an attacker may first write a malicious PHP file and subsequently include it to obtain code execution, resulting in full compromise of the confidentiality, integrity, and availability of the affected site.

The referenced WordPress plugin changeset and Wordfence advisory document that the unsafe extract() and include() pattern has been corrected in the 3.4.2 release; site administrators are advised to update the plugin immediately and to review server configurations that permit arbitrary file writes.

The EPSS score has reached 0.4916 with no reported rise from a lower baseline after disclosure.