Advanced Views
Monthly
Remote code execution in the WordPress "Advanced Views" plugin (by wplake) affects all versions up to and including 3.8.11, allowing an authenticated user with only Subscriber-level privileges to inject and execute arbitrary code (CWE-94) on the server. Rated CVSS 9.9 by Patchstack because a low-privilege account - trivially self-registered on many WordPress sites - can achieve full compromise with no user interaction. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV.
Remote code execution in the WordPress "Advanced Views" plugin (by wplake) affects all versions up to and including 3.8.11, allowing an authenticated user with only Subscriber-level privileges to inject and execute arbitrary code (CWE-94) on the server. Rated CVSS 9.9 by Patchstack because a low-privilege account - trivially self-registered on many WordPress sites - can achieve full compromise with no user interaction. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV.