Description
WordPress JS Help Desk插件是一款用于支持和帮助服务的插件。该插件的storeTheme函数由于对用户输入缺乏充分过滤且缺少权限检查，存在远程代码执行漏洞。攻击者可以通过注入恶意PHP代码完全控制服务器，可能导致敏感信息泄露、数据篡改以及服务中断等严重后果。
WordPress JS Help Desk /wp-admin/admin.php 代码执行漏洞（CVE-2024-7094）
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://nvd.nist.gov/vuln/detail/CVE-2024-7094
https://www.wordfence.com/blog/2024/08/5000-wordpress-sites-affected-by-unauthenticated-remote-code-execution-vulnerability-in-js-help-desk-wordpress-plugin/
https://www.sentinelone.com/vulnerability-database/cve-2024-7094/
https://github.com/advisories/GHSA-344g-jvx4-773r
https://hackhalt.com/threat/cve-2024-7094/
https://cve.imfht.com/detail/CVE-2024-7094?lang=en
https://www.appsecure.security/vulnerability-database/cve-2024-7094/
https://plugins.trac.wordpress.org/browser/js-support-ticket/tags/2.8.5/includes/css/style.php