CVE-2023-49830

The vulnerability results from improper code generation control (CWE-94), which classifies it as code injection. An attacker with Contributor privileges can supply a crafted payload to the application, which will be executed as server-side code. Due to the network vector (AV:N), low attack complexity (AC:L) and changed scope (S:C), the consequences of malicious code execution can extend beyond the plugin itself and affect the entire server.

An attacker can gain full control over the server — read, modify or delete data, and potentially take over the entire WordPress service. The compromise affects confidentiality, integrity and availability of the system at the highest level.

The Astra Pro plugin must be immediately updated to a version higher than 4.3.1, in accordance with the manufacturer's information and the Patchstack database. It is also recommended to review user accounts with the Contributor role and above for unauthorized changes.

Brainstorm Force Astra Pro plugin in all versions from the beginning up to and including 4.3.1.