plugin

Custom Content Type Manager Vulnerabilities

2 known security issues reported for the Custom Content Type Manager WordPress plugin. Most recent disclosed Mar 4, 2016.

1 critical 1 high

Running Custom Content Type Manager on your site? Check whether your installed version is affected.

Scan your site free

Custom Content Type Manager 0.9.8.7 - 0.9.8.8 - Malicious Backdoor

critical

The Custom Content Type Manager plugin for WordPress was injected with a malicious backdoor in versions 0.9.8.7 to 0.9.8.8 that made it possible for attackers to gain access to the server to run code by installing malicious PHP files via the added auto-update.php file.

CVSS:
9.8
Affected:
0.9.8.7 – 0.9.8.8
Fixed in:
0.9.8.9
Disclosed:
Mar 4, 2016

Custom Content Type Manager <= 0.9.8.5 - Authenticated (Admin+) Remote Code Execution

high

The Custom Content Type Manager plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 0.9.8.5 via the "Visibility Control" settings which passes values through eval. This makes it possible for authenticated attackers to execute code on the server.

CVSS:
7.2
Affected:
up to 0.9.8.5
Fixed in:
0.9.8.6
Disclosed:
May 21, 2015

CVE-2015-3173 on NVD →

Protect your WordPress site

Run a free security scan to detect vulnerable plugins and themes, exposed files, and malware — no plugin install, no signup.

Scan your site free

← Back to the vulnerability database