Cwicly
Monthly
Remote code execution in the Cwicly WordPress page-builder plugin (versions 1.4.4 and earlier) allows a low-privileged Contributor-level account to inject and execute arbitrary PHP code on the server, per a Patchstack advisory. Because a Contributor is a low-trust role often granted for guest posting, this collapses the boundary between content authoring and full server compromise. There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV, but the 9.9 CVSS score and CWE-94 code-injection class make it a high-priority patching target.
Remote code execution in the Cwicly WordPress page-builder plugin (versions 1.4.4 and earlier) allows a low-privileged Contributor-level account to inject and execute arbitrary PHP code on the server, per a Patchstack advisory. Because a Contributor is a low-trust role often granted for guest posting, this collapses the boundary between content authoring and full server compromise. There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV, but the 9.9 CVSS score and CWE-94 code-injection class make it a high-priority patching target.