RCE in Sksdev Allow PHP Execute
CVE-2024-13890
The Allow PHP Execute plugin for WordPress is vulnerable to PHP Code Injection in all versions up to, and including, 1.0. This is due to allowing PHP code to be entered by all users for whom unfiltered HTML is allowed. This makes it possible for authenticated attackers, with Editor-level access and above, to inject PHP code into posts and pages.
Vulnerability class: RCE (Remote Code Execution)
EPSS: 0.004 (35.7th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.2 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Sksdev Allow Php Execute — versions 0
- Sksdev Allow_php_execute — versions 1.0
Weakness classification (CWE)
References
- security@wordfence.com (Third Party Advisory)
- security@wordfence.com (Product)
Frequently asked questions
- What is CVE-2024-13890?
- CVE-2024-13890 is a high-severity vulnerability in Sksdev Allow PHP Execute, classified under Code Injection. CVSS score: 7.2/10. Published 2025-03-08.
- How severe is CVE-2024-13890?
- High severity. CVSS v3 base score is 7.2 out of 10.