WordPress plugin
Allow PHP Execute security & vulnerabilities
Unpatched vulnerability in the latest version
At least one vulnerability affects the latest version and no fix has been released. Deactivate the plugin or restrict access to the affected feature until the vendor ships a patch.
- Critical0
- High1
- Medium0
- Low0
All Allow PHP Execute vulnerabilities
| Severity | Vulnerability | CVE | Published |
|---|---|---|---|
| High7.2 | Authenticated (Editor+) PHP Code Injection ≤1.0No patch available | CVE-2024-13890 |
- High7.2Authenticated (Editor+) PHP Code Injection
≤1.0No patch available
Allow PHP Execute: common questions
Does Allow PHP Execute have known vulnerabilities?
Yes. VulnCrest Radar lists 1 known vulnerability in Allow PHP Execute: 1 high. At least one is not fixed in the latest version.
How do I check which version of Allow PHP Execute I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent Allow PHP Execute vulnerability?
CVE-2024-13890, published Mar 7, 2025: Allow PHP Execute <= 1.0 - Authenticated (Editor+) PHP Code Injection. Severity: High (CVSS 7.2).
Is any Allow PHP Execute vulnerability listed in CISA KEV?
No. None of the known Allow PHP Execute vulnerabilities is currently listed in the CISA KEV catalog.