CVE-2023-4019

2023-09-0412:15:10

WPScan

web.nvd.nist.gov

cve-2023-4019

nvd

ftp wordpress plugin

unauthorized access

rce

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

8.6

Confidence

High

EPSS

0.001

Percentile

37.1%

JSON

The Media from FTP WordPress plugin before 11.17 does not properly limit who can use the plugin, which may allow users with author+ privileges to move files around, like wp-config.php, which may lead to RCE in some cases.

Affected configurations

Nvd

Vulners

Node

riverforest-wpmedia_from_ftpRange<11.17wordpress

VendorProductVersionCPE
riverforest-wpmedia_from_ftp*cpe:2.3:a:riverforest-wp:media_from_ftp:*:*:*:*:*:wordpress:*:*

Vendor	Product	Version	CPE
riverforest-wp	media_from_ftp	*	cpe:2.3:a:riverforest-wp:media_from_ftp::::::wordpress::*

CNA Affected

[
  {
    "vendor": "Unknown",
    "product": "Media from FTP",
    "versions": [
      {
        "status": "affected",
        "versionType": "custom",
        "version": "0",
        "lessThan": "11.17"
      }
    ],
    "defaultStatus": "unaffected",
    "collectionURL": "https://wordpress.org/plugins"
  }
]