CVEs-PoC/2021/CVE-2021-24546.md

### [CVE-2021-24546](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-24546)
![](https://img.shields.io/static/v1?label=Product&message=Gutenberg%20Block%20Editor%20Toolkit%20%E2%80%93%20EditorsKit&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=1.31.6%3C%201.31.6%20&color=brighgreen)
![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-94%20Improper%20Control%20of%20Generation%20of%20Code%20('Code%20Injection')&color=brighgreen)

### Description

The Gutenberg Block Editor Toolkit – EditorsKit WordPress plugin before 1.31.6 does not sanitise and validate the Conditional Logic of the Custom Visibility settings, allowing users with a role as low contributor to execute Arbitrary PHP code

### POC

#### Reference
- https://wpscan.com/vulnerability/bdc36f6a-682d-4d66-b587-92e86085d971

#### Github
- https://github.com/ARPSyndicate/cvemon