{"vulnerability": "CVE-2024-8672", "sightings": [{"uuid": "0ca9370c-9738-4279-88c5-f2fde13e98e8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-8672", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/113560012299864959", "content": "", "creation_timestamp": "2024-11-28T10:04:34.795671Z"}, {"uuid": "3ffe1c9a-e4b7-491f-92e6-05d460df0d92", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-8672", "type": "seen", "source": "https://t.me/CyberBulletin/1660", "content": "\u26a1\ufe0fCVE-2024-8672 (CVSS 9.9): Critical Flaw in Widget Options Plugin Threatens 100,000+ Websites.\n\n#CyberBulletin", "creation_timestamp": "2024-12-01T08:41:51.000000Z"}, {"uuid": "d45d6e9d-163c-4aaa-9cb9-00eb169009ee", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-8672", "type": "published-proof-of-concept", "source": "https://t.me/haj3imad/20931", "content": "https://github.com/Chocapikk/CVE-2024-8672\n\nWidget Options \u2013 The #1 WordPress Widget & Block Control Plugin <= 4.0.7 - Authenticated (Contributor+) Remote Code Execution\n#github #exploit #poc", "creation_timestamp": "2024-12-05T03:43:58.000000Z"}, {"uuid": "62cbf8f2-e808-48f7-b18d-a25c013e9580", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-8672", "type": "seen", "source": "https://t.me/CyberBulletin/26672", "content": "\u26a1\ufe0fCVE-2024-8672 (CVSS 9.9): Critical Flaw in Widget Options Plugin Threatens 100,000+ Websites.\n\n#CyberBulletin", "creation_timestamp": "2024-12-01T08:41:51.000000Z"}, {"uuid": "c21d9ee3-79ba-4cab-b07f-f381981024d5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-8672", "type": "published-proof-of-concept", "source": "https://t.me/CyberSecurityTechnologies/11517", "content": "#exploit\n1. CVE-2024-49039:\nWindows Task Scheduler EoP\nhttps://github.com/je5442804/WPTaskScheduler_CVE-2024-49039\n\n2. CVE-2024-44308:\nApple Safari JavaScriptCore RCE\nhttp://threat-intelligence.llm.re.kr/2024-12-01/CVE-2024-44308\n\n3. CVE-2024-8672:\nAuthenticated Contributor RCE in Widget Options Plugin\nhttps://github.com/Chocapikk/CVE-2024-8672", "creation_timestamp": "2024-12-04T19:24:08.000000Z"}, {"uuid": "383201fd-1792-40b3-bef7-7bb211a6e34e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-8672", "type": "seen", "source": "https://t.me/Rootsec_2/5375", "content": "#exploit\n1. CVE-2024-49039:\nWindows Task Scheduler EoP\nhttps://github.com/je5442804/WPTaskScheduler_CVE-2024-49039\n\n2. CVE-2024-44308:\nApple Safari JavaScriptCore RCE\nhttp://threat-intelligence.llm.re.kr/2024-12-01/CVE-2024-44308\n\n3. CVE-2024-8672:\nAuthenticated Contributor RCE in Widget Options Plugin\nhttps://github.com/Chocapikk/CVE-2024-8672", "creation_timestamp": "2024-12-05T07:26:57.000000Z"}, {"uuid": "dcc21b38-c8c1-4c61-b0b5-370916303f85", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-8672", "type": "seen", "source": "https://t.me/DEVIL_La_RSx/2294", "content": "#exploit\n1. CVE-2024-49039:\nWindows Task Scheduler EoP\nhttps://github.com/je5442804/WPTaskScheduler_CVE-2024-49039\n\n2. CVE-2024-44308:\nApple Safari JavaScriptCore RCE\nhttp://threat-intelligence.llm.re.kr/2024-12-01/CVE-2024-44308\n\n3. CVE-2024-8672:\nAuthenticated Contributor RCE in Widget Options Plugin\nhttps://github.com/Chocapikk/CVE-2024-8672", "creation_timestamp": "2024-12-04T17:10:28.000000Z"}, {"uuid": "125b7e01-532b-4726-9818-6e5228d6b4e3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-8672", "type": "seen", "source": "https://t.me/brutsecurity/1162", "content": "CVE-2024-8672: Code Injection in Widget Options WordPress Plugin, 9.9 rating \ud83d\udd25\n\nThe vulnerability allows an attacker to enter data that is transmitted without proper filtering. This could potentially lead to remote code execution.\n\nSearch at Netlas.io:\n\ud83d\udc49 Link: https://nt.ls/xOEZp\n\ud83d\udc49 Dork: http.body:\"plugins/widget-options\"\n\nRead more: https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/widget-options/widget-options-the-1-wordpress-widget-block-control-plugin-407-authenticated-contributor-remote-code-execution", "creation_timestamp": "2026-07-09T03:00:11.258897Z"}, {"uuid": "954cd5cc-d0a7-486a-bff4-5118ef35c09c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-8672", "type": "seen", "source": "https://t.me/brutsecurity/1162", "content": "CVE-2024-8672: Code Injection in Widget Options WordPress Plugin, 9.9 rating \ud83d\udd25\n\nThe vulnerability allows an attacker to enter data that is transmitted without proper filtering. This could potentially lead to remote code execution.\n\nSearch at Netlas.io:\n\ud83d\udc49 Link: https://nt.ls/xOEZp\n\ud83d\udc49 Dork: http.body:\"plugins/widget-options\"\n\nRead more: https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/widget-options/widget-options-the-1-wordpress-widget-block-control-plugin-407-authenticated-contributor-remote-code-execution", "creation_timestamp": "2026-07-10T00:00:35.687147Z"}, {"uuid": "057df850-b8a2-4752-bf3d-8b6d0fc6b11c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-8672", "type": "published-proof-of-concept", "source": "https://t.me/brutsecurity/1162", "content": "CVE-2024-8672: Code Injection in Widget Options WordPress Plugin, 9.9 rating \ud83d\udd25\n\nThe vulnerability allows an attacker to enter data that is transmitted without proper filtering. This could potentially lead to remote code execution.\n\nSearch at Netlas.io:\n\ud83d\udc49 Link: https://nt.ls/xOEZp\n\ud83d\udc49 Dork: http.body:\"plugins/widget-options\"\n\nRead more: https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/widget-options/widget-options-the-1-wordpress-widget-block-control-plugin-407-authenticated-contributor-remote-code-execution", "creation_timestamp": "2026-07-11T16:00:03.067744Z"}, {"uuid": "b63ca6bd-76de-4e95-bb7d-5fd366e4f987", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-8672", "type": "published-proof-of-concept", "source": "https://t.me/brutsecurity/1162", "content": "CVE-2024-8672: Code Injection in Widget Options WordPress Plugin, 9.9 rating \ud83d\udd25\n\nThe vulnerability allows an attacker to enter data that is transmitted without proper filtering. This could potentially lead to remote code execution.\n\nSearch at Netlas.io:\n\ud83d\udc49 Link: https://nt.ls/xOEZp\n\ud83d\udc49 Dork: http.body:\"plugins/widget-options\"\n\nRead more: https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/widget-options/widget-options-the-1-wordpress-widget-block-control-plugin-407-authenticated-contributor-remote-code-execution", "creation_timestamp": "2026-07-12T00:00:45.775961Z"}, {"uuid": "e36872dd-fb57-4cd7-a9c7-30d9ab256e11", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-8672", "type": "seen", "source": "https://t.me/pphm_HackerNews/24", "content": "\ud83d\udd34 CVE-2024-8672 Authenticated Contributor RCE in Widget Options WordPress Plugin\n\nThe Widget Options of the WordPress plugin (version 4.0.7 and earlier) have become vulnerable to Remote Code Execution (RCE) with Contributor privileges. This vulnerability allows authenticated users with Contributor privileges or higher to execute arbitrary PHP code on the target server.", "creation_timestamp": "2026-07-20T22:00:05.090155Z"}, {"uuid": "e16f130f-2f66-4a99-9196-840fbbc1b6ad", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-8672", "type": "seen", "source": "https://t.me/pphm_HackerNews/24", "content": "\ud83d\udd34 CVE-2024-8672 Authenticated Contributor RCE in Widget Options WordPress Plugin\n\nThe Widget Options of the WordPress plugin (version 4.0.7 and earlier) have become vulnerable to Remote Code Execution (RCE) with Contributor privileges. This vulnerability allows authenticated users with Contributor privileges or higher to execute arbitrary PHP code on the target server.", "creation_timestamp": "2026-07-21T00:00:09.270118Z"}]}