Lucene search
HistoryJan 16, 2024 - 4:15 p.m.
CVE-2023-4536
wordpress
plugin
file upload
rce
security vulnerability
CVSS3
8.8
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
AI Score
8.7
Confidence
High
EPSS
0.001
Percentile
19.3%
The My Account Page Editor WordPress plugin before 1.3.2 does not validate the profile picture to be uploaded, allowing any authenticated users, such as subscriber to upload arbitrary files to the server, leading to RCE
Affected configurations
Node
koalaappsmy_account_page_editorRange<1.3.2wordpress
| Vendor | Product | Version | CPE |
|---|---|---|---|
| koalaapps | my_account_page_editor | * | cpe:2.3:a:koalaapps:my_account_page_editor:*:*:*:*:*:wordpress:*:* |
Related
cvelist
cvelist
wpvulndb
wpvulndb
My Account Page Editor < 1.3.2 - Subscriber+ Arbitrary File Upload
2023-09-06 00:00:00
prion
prion
Code injection
2024-01-16 16:15:00
cve
cve
CVE-2023-4536
2024-01-16 16:15:13
wpexploit
wpexploit
My Account Page Editor < 1.3.2 - Subscriber+ Arbitrary File Upload
2023-09-06 00:00:00
wordfence
wordfence
CVSS3
8.8
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
AI Score
8.7
Confidence
High
EPSS
0.001
Percentile
19.3%
Related for NVD:CVE-2023-4536