جزئیات آسیب‌پذیری
CVE-2026-6443
essentialplugin Accordion and Accordion Slideressentialplugin Album and Image Gallery Plus Lightboxessentialplugin Blog Designer – Post and Widgetessentialplugin Countdown Timer Ultimateessentialplugin Featured Post Creativeessentialplugin Meta Slider and Carousel with Lightbox
Essentialplugin Plugins (Various Versions) - Injected Backdoor
CVSS 3.1
9.8بحرانی
شرح رسمی (انگلیسی)
All plugins by Essentialplugin for WordPress are vulnerable to an injected backdoor in various versions. This is due to the plugin being sold to a malicious threat actor that embedded a backdoor in all of the plugin's they acquired. This makes it possible for the threat actor to maintain a persistent backdoor and inject spam into the affected sites.
امتیازهای CVSS
| امتیاز | نسخه | منبع | بردار |
|---|---|---|---|
| 9.8بحرانی | 3.1 | CVEProject cvelistV5 (CNA) (Wordfence) | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
محصولات آسیب‌پذیر
| فروشنده | محصول | نسخه‌ها | منبع |
|---|---|---|---|
| essentialplugin | Accordion and Accordion Slider | 1.4.6 | CVEProject cvelistV5 (CNA) |
| essentialplugin | Album and Image Gallery Plus Lightbox | 2.1.8 | CVEProject cvelistV5 (CNA) |
| essentialplugin | Blog Designer – Post and Widget | 2.7.7 | CVEProject cvelistV5 (CNA) |
| essentialplugin | Countdown Timer Ultimate | 2.6.9 | CVEProject cvelistV5 (CNA) |
| essentialplugin | Featured Post Creative | 1.5.7 | CVEProject cvelistV5 (CNA) |
| essentialplugin | Meta Slider and Carousel with Lightbox | 2.0.8 | CVEProject cvelistV5 (CNA) |
| essentialplugin | Popup Maker and Popup Anything – Popup for opt-ins and Lead Generation Conversions | 2.9.1 | CVEProject cvelistV5 (CNA) |
| essentialplugin | Portfolio and Projects | 1.5.6 | CVEProject cvelistV5 (CNA) |
| essentialplugin | Post Ticker Ultimate | 1.7.6 | CVEProject cvelistV5 (CNA) |
| essentialplugin | Post grid and filter ultimate | 1.7.4 | CVEProject cvelistV5 (CNA) |
| essentialplugin | Team Slider and Team Grid Showcase plus Team Carousel | 2.8.6 | CVEProject cvelistV5 (CNA) |
| essentialplugin | Testimonial Grid and Testimonial Slider plus Carousel with Rotator Widget | 3.5.6 | CVEProject cvelistV5 (CNA) |
| essentialplugin | Timeline and History slider | 2.4.5 | CVEProject cvelistV5 (CNA) |
| essentialplugin | Trending/Popular Post Slider and Widget | 1.8.6 | CVEProject cvelistV5 (CNA) |
| essentialplugin | Video gallery and Player | 2.8.7 | CVEProject cvelistV5 (CNA) |
| essentialplugin | WP Blog and Widgets | 2.6.6 | CVEProject cvelistV5 (CNA) |
| essentialplugin | WP Featured Content and Slider | 1.7.6 | CVEProject cvelistV5 (CNA) |
| essentialplugin | WP Logo Showcase Responsive Slider and Carousel | 3.8.7 | CVEProject cvelistV5 (CNA) |
| essentialplugin | WP News and Scrolling Widgets | 5.0.6 | CVEProject cvelistV5 (CNA) |
| essentialplugin | WP Responsive Recent Post Slider/Carousel | 3.7.1 | CVEProject cvelistV5 (CNA) |
| essentialplugin | WP Slick Slider and Image Carousel | 3.7.8.1 | CVEProject cvelistV5 (CNA) |
| essentialplugin | WP responsive FAQ with category plugin | 3.9.5 | CVEProject cvelistV5 (CNA) |
منابع و راهنماها
۲
هشدار CVEهای بعدی این محصولمحصول را دنبال کنید تا آسیب‌پذیری‌های تازه را در تلگرام بگیرید.
اطلاعات
- تاریخ انتشار
- ۱۴۰۵/۰۱/۲۸
- آخرین به‌روزرسانی
- ۱۴۰۵/۰۲/۰۱
- وضعیت
- منتشرشده
- صادرکننده (CNA)
- Wordfence
پیش‌بینی بهره‌برداری (EPSS)
۰٫۴۹٪
احتمال بهره‌برداری در ۳۰ روز
۴۲٫۶٪
صدک (نسبت به همه‌ی CVEها)
ارزیابی SSVC (CISA)
- قابل خودکارسازی
- بله
- وضعیت بهره‌برداری
- ندارد
- اثر فنی
- کامل
ضعف‌ها (CWE)
- CWE-506Embedded Malicious Code