CVE-2024-7094

CVE-2024-7094 is a critical-severity vulnerability with a CVSS 3.x base score of 9.8. Its EPSS exploit-prediction score of 38% places it in the 98th percentile, indicating an elevated likelihood of exploitation. The underlying weakness is classified as CWE-94.

Key facts

Description

The JS Help Desk – The Ultimate Help Desk & Support Plugin plugin for WordPress is vulnerable to PHP Code Injection leading to Remote Code Execution in all versions up to, and including, 2.8.6 via the 'storeTheme' function. This is due to a lack of sanitization on user-supplied values, which replace values in the style.php file, along with missing capability checks. This makes it possible for unauthenticated attackers to execute code on the server. This issue was partially patched in 2.8.6 when the code injection issue was resolved, and fully patched in 2.8.7 when the missing authorization and cross-site request forgery protection was added. CVE-2024-43274 is likely a duplicate of this issue.

Frequently asked questions

What is CVE-2024-7094?
The JS Help Desk – The Ultimate Help Desk & Support Plugin plugin for WordPress is vulnerable to PHP Code Injection leading to Remote Code Execution in all versions up to, and including, 2.8.6 via the 'storeTheme' function. This is due to a lack of sanitization on user-supplied values, which replace values in the style.php file, along with missing capability checks. This makes it possible for unauthenticated attackers to execute code on the server. This issue was partially patched in 2.8.6 when the code injection issue was resolved, and fully patched in 2.8.7 when the missing authorization and cross-site request forgery protection was added. CVE-2024-43274 is likely a duplicate of this issue.
How severe is CVE-2024-7094?
CVE-2024-7094 has a CVSS 3.x base score of 9.8, rated critical severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.
Is CVE-2024-7094 being actively exploited?
It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 38% (98th percentile), an estimate of the probability of exploitation in the next 30 days.
How do I fix CVE-2024-7094?
Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.
Does CVE-2024-7094 have an EU (EUVD) identifier?
Yes. CVE-2024-7094 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2024-48080.
When was CVE-2024-7094 published?
CVE-2024-7094 was published on 2024-08-13 and last updated on 2026-06-17.

References

Other CWE-94 (Code Injection) vulnerabilities

Browse all CWE-94 (Code Injection) vulnerabilities →