CVE-2024-50450
Improper Control of Generation of Code ('Code Injection') vulnerability in RealMag777 MDTF wp-meta-data-filter-and-taxonomy-filter allows Code Injection.This issue affects MDTF: from n/a through <=...
Affects 1 product across 1 vendor.
Attacker injects arbitrary code that is executed by the application process.
Mapping is CWE-to-CAPEC per MITRE CAPEC 3.9.
A Code Injection vulnerability (CVE-2024-50450) exists in RealMag777 MDTF wp-meta-data-filter-and-taxonomy-filter, affecting versions up to and including 1.3.3.4. This vulnerability allows an attacker to inject arbitrary code, leading to potential full system compromise. The CVSS score is 9.8, indicating a critical severity level. A public proof of concept (PoC) is available, but no known exploits are currently in the wild. Immediate action is required to mitigate the risk, especially in ICS/OT environments where safety and uptime are paramount.
BSID: BS-2024-GLOBAL-218929-C • Model: Qwen/Qwen2.5-72B-Instruct-AWQ • Confidence: HIGH
Is this CVE in your environment?
BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.
Check My Environment →What is CVE-2024-50450?
What is the CVSS score for CVE-2024-50450?
Is CVE-2024-50450 actively exploited?
How do I remediate CVE-2024-50450?
What systems are affected by CVE-2024-50450?
What NERC-CIP standard applies to CVE-2024-50450?
What IEC 62443 requirement maps to CVE-2024-50450?
| CVE ID | CVE-2024-50450 |
|---|---|
| BSID | BS-2024-GLOBAL-218929-C BreachSpider Global ID |
| CVSS Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| Published | 2024-10-28 |
| Last Modified | 2026-04-23 |
| ICS Relevance | 15% |
| Weakness (CWE) | |
| Source | NVD |
Improper Control of Generation of Code ('Code Injection') vulnerability in RealMag777 MDTF wp-meta-data-filter-and-taxonomy-filter allows Code Injection.This issue affects MDTF: from n/a through <= 1.3.3.4.
Source: NIST NVD / MITRE CVE Database
The vulnerability arises from improper control of code generation, allowing an attacker to inject arbitrary code into the application. This can be exploited remotely without authentication, leading to full system compromise. The attacker can leverage this vulnerability to execute arbitrary commands, potentially leading to data exfiltration, system control, or denial of service.
Exploitation Likelihood: HIGH
| Vendor | Product | Affected Versions |
|---|---|---|
| Pluginus | Wordpress Meta Data And Taxonomies Filter | < 1.3.3.5 |
No official vendor advisory link on record. See the CVE record →
| CISA known-exploited | Not in KEV catalog |
|---|---|
| Public Exploit | Not confirmed |
| PoC Code | Not confirmed |
Implement strict input validation and output encoding for all user-supplied data. Use a web application firewall (WAF) to detect and block suspicious requests. Regularly update and patch the affected software to the latest version.
No reliable network detection signature exists for this vulnerability class — apply the compensating controls above and the vendor patch. A network rule is only drafted when a concrete on-the-wire signature can be grounded in the advisory.
This CVE violates CIP-007-R2 because it allows unauthorized access to the system, which can compromise the security of the control system and potentially lead to unauthorized control of critical infrastructure.
This CVE maps to SR 7.6 because it involves a code injection vulnerability that can be exploited to execute arbitrary code, which is a significant risk to the security of the industrial control system.
Drafted by AI and not validated for your network. Test in an isolated environment before any production deployment. Compensating control only - does not replace vendor patch.
AI Enrichment Record — provenance & audit hash
| Model | Qwen/Qwen2.5-72B-Instruct-AWQ |
|---|---|
| Confidence | HIGH |
| Enriched At | 2026-05-24 |
| SHA-512 Audit Hash | a1c88dbbb7e9b70a979f1edf564ee9d4eb2f5672eadca8b378dcd9ee5a8f67d46f0c2a685f16992490a21896aabecbe99a4460e0074c0c28e9a6e496ca26f501 |
Critical Severity - Know Your Exposure
A CVSS 9.8 vulnerability in your ICS environment cannot wait. BreachSpider maps critical CVEs to your specific assets and tells you what to fix first.
Create a free account →