CVE-2023-5201

Name of the Vulnerable Software and Affected Versions OpenHook plugin for WordPress versions up to, and including, 4.3.0

Description The issue allows authenticated attackers with subscriber-level permissions or above to execute code on the server via the php shortcode. This requires the [php] shortcode setting to be enabled on the vulnerable site.

Recommendations For versions up to, and including, 4.3.0, consider disabling the php shortcode setting to prevent exploitation until a patch is available. As a temporary workaround, restrict access to the site for users with subscriber-level permissions or above to minimize the risk of exploitation.