An issue found in ProcessWire 3.0.210 allows attackers to execute arbitrary code and install a reverse shell via the download_zip_url parameter when installing a new module. NOTE: this is disputed because exploitation requires that the attacker is able to enter requests as an admin; however, a ProcessWire admin is intentionally allowed to install any module that contains any arbitrary code.
Conclusion & alert: CVE-2023-24676 is rated High Exploit Risk (68.4/100): CVSS High severity, with medium exploitation likelihood (EPSS 1.31%).Core evidence: 1 public exploit reference(s) are indexed (Exploit-DB). EPSS rose +1.22% over the last day, indicating growing attacker interest.Mandatory action: Public exploits are available—assess exposure, apply mitigations, and prioritize patching.
Risk is dynamic; we continuously reassess and refresh what is shown on this page as upstream context changes.
Public exploit references (Exploit-DB) for CVE-2023-24676
Exploit prediction scoring system (EPSS) score for CVE-2023-24676
EPSS lead: Daily EPSS estimates relative likelihood of exploitation; percentile ranks this CVE among scored vulnerabilities (higher = more severe relative rank).