An authenticated remote code execution vulnerability in the Cwicly WordPress plugin allows attackers with contributor-level access to compromise the host server.

This is a code injection vulnerability that allows authenticated users to bypass security controls and execute arbitrary code on the server. The attack requires authenticated access, specifically at the contributor level or higher.

The ability for an authenticated user to execute arbitrary code on the underlying server represents a total system compromise. This allows attackers to install backdoors, steal sensitive site data, or leverage the server for further attacks, potentially leading to significant reputational and operational damage given the high CVSS score of 9.9.

Immediate Action: Update the Cwicly plugin to the latest version. If a patch is not yet available, immediately deactivate and remove the plugin from the WordPress installation until a secure version is released.

Proactive Monitoring: Audit WordPress user accounts and capabilities to ensure that no unauthorized users have contributor-level access or higher.

Compensating Controls: Employ a Web Application Firewall (WAF) with rules configured to detect and block common code injection patterns directed at WordPress plugins.

Public Exploit Available: No confirmed public weaponized exploit available.

Due to the critical severity and the potential for total system compromise, immediate attention is required. Administrators should verify the current plugin version and apply updates or mitigations without delay to prevent potential abuse by malicious actors with existing low-level site access.