Nicepage 4160 Exploit

Nicepage is a popular WordPress plugin used for visual site building. In versions prior to 2.15.2, the plugin contained a critical flaw that allowed unauthenticated attackers to upload arbitrary files to the target server.

Due to insufficient file validation during the import process, this vulnerability allows a remote attacker to upload malicious PHP files (webshells), leading to Remote Code Execution (RCE). This effectively grants the attacker full control over the WordPress installation and potentially the underlying server.

Product: Nicepage – Drag & Drop WordPress Theme Builder & Landing Page Builder Vulnerability Type: Unauthenticated Arbitrary File Upload CVE ID: CVE-2024-4160 CVSS Score: 10.0 (Critical) Affected Versions: < 2.15.2 Patch Version: 2.15.2 nicepage 4160 exploit