CVE-2023-24676 Arbitrary Code Execution in Processwire

High 7.2 Published 24 Jan 2024 Updated 17 Oct 2025

Administrators can execute arbitrary code via the module installation feature, though this is disputed as it aligns with intended admin privileges.

Exploited in the wild: Not known
Login needed: An administrator
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2023-24676?

CVE-2023-24676 is a high-severity code injection vulnerability in n/a, published on 24 Jan 2024. An attacker needs administrator access to exploit it, with no action from the victim.

Official description

An issue found in ProcessWire 3.0.210 allows attackers to execute arbitrary code and install a reverse shell via the download_zip_url parameter when installing a new module. NOTE: this is disputed because exploitation requires that the attacker is able to enter requests as an admin; however, a ProcessWire admin is intentionally allowed to install any module that contains any arbitrary code.

Weakness: CWE-94

Which versions are affected by CVE-2023-24676?

2 open source packages ship an affected version, including processwire/processwire. It affects 1 product.

Package	Affected	Fixed in
`processwire/processwire` Packagist	All versions to `3.0.210`	None
`processwire/processwire` Packagist	All versions to `3.0.210`	None

Products include Processwire Processwire.

How do I fix CVE-2023-24676?

No fix has been published for CVE-2023-24676 yet. Limit exposure of the affected software until one is available.

Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.

Is CVE-2023-24676 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-24676 exists.

Sources

Also known as GHSA-2cvg-w29m-j8xc.