CVE-2024-34434 WordPress MDTF – Meta Data and Taxonomies Filter plugin <= 1.3.3.2 - Arbitrary Shortcode Execution vulnerability

What is CVE-2024-34434?

CVE-2024-34434 is a medium-severity code injection vulnerability in realmag777 WordPress Meta Data and Taxonomies Filter (MDTF), published on 17 May 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Incorrect Authorization vulnerability in realmag777 WordPress Meta Data and Taxonomies Filter (MDTF) allows Code Inclusion, Functionality Misuse.This issue affects WordPress Meta Data and Taxonomies Filter (MDTF): from n/a through 1.3.3.2.

Weakness: CWE-863

Which versions are affected by CVE-2024-34434?

It affects 1 product.

Products include Pluginus Wordpress Meta Data and Taxonomies Filter.

How do I fix CVE-2024-34434?

No fix has been published for CVE-2024-34434 yet. Limit exposure of the affected software until one is available.

Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.

Is CVE-2024-34434 being exploited?

There is no known exploitation of CVE-2024-34434 in the wild and no public exploit code.

Other vulnerabilities in realmag777 WordPress Meta Data and Taxonomies Filter (MDTF)

• CVE-2024-8624 MDTF – Meta Data and Taxonomies Filter <= 1.3.3.3 - Authenticated (Contributor+) SQL Injection Critical 9.9
• CVE-2021-20781 Cross-site request forgery in WordPress Meta Data Filter & Taxonomies Filter High 8.8
• CVE-2024-50450 WordPress MDTF – Meta Data and Taxonomies Filter plugin <= 1.3.3.4 - Bypass Vulnerability vulnerability High 7.3
• CVE-2024-8623 MDTF – Meta Data and Taxonomies Filter <= 1.3.3.3 - Unauthenticated Arbitrary Shortcode Execution High 7.3
• CVE-2024-29763 WordPress MDTF – Meta Data and Taxonomies Filter plugin <= 1.3.3 - Cross Site Scripting (XSS) vulnerability High 7.1

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-6hx5-97h6-52x3.