Critical RCE Flaws in ‘PHP Everywhere’ Plugin Affect Thousands of WordPress Sites

Critical security vulnerabilities have been disclosed in a
WordPress plugin known as PHP Everywhere that’s used by more than
30,000 websites worldwide and could be abused by an attacker to
execute arbitrary code on affected systems.

PHP Everywhere is used^[1]
to flip the switch on PHP code across WordPress installations,
enabling users to insert and execute PHP-based code in the content
management system’s Pages, Posts, and Sidebar.

The three issues, all rated 9.9 out of a maximum of 10 on the
CVSS rating system, impact versions 2.0.3 and below, and are as
follows –

• CVE-2022-24663 – Remote Code Execution by
  Subscriber+ users via shortcode
• CVE-2022-24664 – Remote Code Execution by
  Contributor+ users via metabox, and
• CVE-2022-24665 – Remote Code Execution by
  Contributor+ users via gutenberg block

Successful exploitation of the three vulnerabilities could
result in the execution of malicious PHP code that could be
leveraged to achieve a complete site takeover.

WordPress security company Wordfence said^[2]
it disclosed the shortcomings to the plugin’s author, Alexander
Fuchs, on January 4, following which updates were issued on January
12, 2022 with version 3.0.0 by removing the vulnerable code
entirely.

“The update to version 3.0.0 of this plugin is a breaking change
that removes the [php_everywhere] shortcode and widget,” the
updated description page of the plugin now reads. “Run the upgrade
wizard from the plugin’s settings page to migrate your old code to
Gutenberg blocks.”

It’s worth noting that version 3.0.0 only supports PHP snippets
via the Block editor^[3], necessitating that
users who are still relying on the Classic Editor^[4]
to uninstall the plugin and download an alternative solution for
hosting custom PHP code.