CVE-2023-34385CWE-434

WordPress Export Import Menus Plugin <= 1.8.0 is vulnerable to Arbitrary File Upload

Critical · published December 20, 2023

CVSS v3.1
9.9
EPSS
1%
Percentile
55.7
In the wild
Unconfirmed
What it is

🚨 An unrestricted file upload vulnerability could let an attacker send dangerous files directly to your server! 🔥 Think of it like allowing a delivery driver to drop off any package without checking the contents—what if they brought something harmful instead of your new kitchen appliance? If exploited, attackers could upload malicious files that could infect your server, execute harmful scripts, or even take complete control of your system! This kind of breach could lead to devastating data loss, unauthorized access, or worse—a full server compromise.

Put simply

Think of it like allowing a delivery driver to drop off any package without checking the contents—what if they brought something harmful instead of your new kitchen appliance? This vulnerability in Akshay Menariya Export Import Menus allows users to upload files of any type without proper validation, exposing the server to potential threats.

What to do

If exploited, attackers could upload malicious files that could infect your server, execute harmful scripts, or even take complete control of your system! This kind of breach could lead to devastating data loss, unauthorized access, or worse—a full server compromise. To protect your system, immediately update to version 1.8.1 to close this vulnerability. Additionally, implement strict file type checks and ensure you have robust security measures in place for file uploads. You’ve got this! Follow these steps and your defenses will be stronger than ever. 🛡️

The record
Technical detail
CVSS v3.1
9.9 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00787 · 55.7th percentile
Weakness
CWE-434 · Unrestricted Upload of File with Dangerous Type
Published
2023-12-20T18:44Z
EPSS history
Timeline
  • 20 DEC 18:44Z
    WordPress Export Import Menus Plugin <= 1.8.0 is vulnerable to Arbitrary File Upload
    cvelistv5