CVE-2022-24665 PHP Code Snippets were included in 2.0.3 of PHP Everywhere, which allowed execution of code snippets by any user able to edit posts.

This functionality was intentionally disabled by the developers of the plugin in order to prevent any possible security issues.

The snipped code could be posted by any user of WordPress, which could lead to Cross-Site Scripting (XSS), a major cause of website hacking.

Now it’s clear that the upgrade to the current version of PHP-E 2.0.4 is mandatory in order to avoid any possible XSS attacks.

What’s the recommended solution to this issue? - If you’re using any previous version of the plugin, you must update it to the latest version.

WordPress core update

In order to avoid any security issues, it is necessary to update your WordPress core. The snipped code is just that, a snippet of code from the plugin’s settings page. You should refrain from using that because it could cause Cross-site scripting (XSS) attacks.
The best solution to this issue is to update your WordPress core so that you’re running on the latest version of PHP - E 2.0.4

Timeline

Published on: 02/16/2022 17:15:00 UTC
Last modified on: 02/24/2022 15:19:00 UTC

References

• https://www.wordfence.com/blog/2022/02/critical-vulnerabilities-in-php-everywhere-allow-remote-code-execution/
• https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-24665