What’s Vulnerable › Vulnerabilities

CVE-2023-53872: Wp2Fac 1.0 OS Command Injection via send.php Endpoint

• Severity: critical (CVSS 9.3 v4.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.1% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-12-15 · updated 2026-06-17
• Weakness: CWE-78

Description

Wp2Fac 1.0 contains an OS command injection vulnerability in the send.php endpoint that allows remote attackers to execute arbitrary system commands. Attackers can inject shell commands through the 'numara' parameter by appending shell commands with '&' operators to execute malicious code.

Affected products

• Wp2Fac: 1.0

References

• https://github.com/metinyesil/wp2fac
• https://www.exploit-db.com/exploits/51717
• https://www.vulncheck.com/advisories/wpfac-os-command-injection-via-sendphp-endpoint

Get alerted when CVE-2023-53872 or the next vulnerability affects your stack