CVE-2023-0467

WP Dark Mode < 4.0.8 - Subscriber+ Local File Inclusion

Medium · published March 27, 2023

CVSS v3.1
4.3
EPSS
1%
Percentile
51.7
In the wild
Unconfirmed
What it is

The WP Dark Mode WordPress plugin before 4.0.8 does not properly sanitize the style parameter in shortcodes before using it to load a PHP template. This leads to Local File Inclusion on servers where non-existent directories may be traversed, or when chained with another vulnerability allowing arbitrary directory creation.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00678 · 51.7th percentile
Published
2023-03-27T15:37Z
EPSS history
Timeline
  • 27 MAR 15:37Z
    WP Dark Mode < 4.0.8 - Subscriber+ Local File Inclusion
    cvelistv5