CVE-2023-0477

Auto Featured Image < 3.9.16 - Author+ Arbitrary File Upload

published March 13, 2023

CVSS
—
EPSS
2%
Percentile
76.3
In the wild
Unconfirmed
What it is

The Auto Featured Image (Auto Post Thumbnail) WordPress plugin before 3.9.16 includes an AJAX endpoint that allows any user with at least Author privileges to upload arbitrary files, such as PHP files. This is caused by incorrect file extension validation.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01645 · 76.3th percentile
Published
2023-03-13T16:03Z
EPSS history
Timeline
  • 13 MAR 16:03Z
    Auto Featured Image < 3.9.16 - Author+ Arbitrary File Upload
    cvelistv5