CVE-2023-0255

2023-02-1315:15:21

CWE-434

WPScan

web.nvd.nist.gov

cve-2023-0255

wordpress

plugin

security vulnerability

nvd

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

8.7

Confidence

High

EPSS

0.001

Percentile

43.5%

JSON

The Enable Media Replace WordPress plugin before 4.0.2 does not prevent authors from uploading arbitrary files to the site, which may allow them to upload PHP shells on affected sites.

Affected configurations

Nvd

Vulners

Node

shortpixelenable_media_replaceRange<4.0.2wordpress

VendorProductVersionCPE
shortpixelenable_media_replace*cpe:2.3:a:shortpixel:enable_media_replace:*:*:*:*:*:wordpress:*:*

Vendor	Product	Version	CPE
shortpixel	enable_media_replace	*	cpe:2.3:a:shortpixel:enable_media_replace::::::wordpress::*

CNA Affected

[
  {
    "vendor": "Unknown",
    "product": "Enable Media Replace",
    "versions": [
      {
        "status": "affected",
        "versionType": "custom",
        "version": "0",
        "lessThan": "4.0.2"
      }
    ],
    "defaultStatus": "unaffected",
    "collectionURL": "https://wordpress.org/plugins"
  }
]