CVE-2023-4536

My Account Page Editor < 1.3.2 - Subscriber+ Arbitrary File Upload

High · published January 16, 2024

CVSS v3.1
8.8
EPSS
1%
Percentile
63.3
In the wild
Unconfirmed
What it is

The My Account Page Editor WordPress plugin before 1.3.2 does not validate the profile picture to be uploaded, allowing any authenticated users, such as subscriber to upload arbitrary files to the server, leading to RCE

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.01026 · 63.3th percentile
Published
2024-01-16T15:56Z
EPSS history
Timeline
  • 16 JAN 15:56Z
    My Account Page Editor < 1.3.2 - Subscriber+ Arbitrary File Upload
    cvelistv5