CVE-2023-47846CWE-434

WordPress WP Githuber MD plugin <= 1.16.2 - Arbitrary File Upload vulnerability

Critical · published March 26, 2024

CVSS v3.1
9.1
EPSS
1%
Percentile
48.2
In the wild
Unconfirmed
What it is

🚨 Unrestricted file uploads are open for business! This vulnerability in WP Githuber MD allows any user to upload dangerous file types, potentially causing chaos. 🔥 Think of it like a restaurant that allows customers to bring in any dish — including expired food or hidden allergens — without checking. It's a recipe for disaster if someone decides to serve up something harmful! An attacker could upload malicious files, leading to remote code execution on your server. This means they could potentially hijack your website, steal sensitive data, and even deface your content! This vulnerability is absolutely devastating to your site’s integrity.

Put simply

Think of it like a restaurant that allows customers to bring in any dish — including expired food or hidden allergens — without checking. It's a recipe for disaster if someone decides to serve up something harmful! This flaw allows unauthorized users to upload files of dangerous types, bypassing security checks entirely, and it affects WP Githuber MD versions from n/a to 1.16.2.

What to do

An attacker could upload malicious files, leading to remote code execution on your server. This means they could potentially hijack your website, steal sensitive data, and even deface your content! This vulnerability is absolutely devastating to your site’s integrity. Immediately patch your WP Githuber MD to the latest version to close this security gap. Additionally, implement strict file type validation to ensure only safe uploads are permitted. Regularly review your upload processes to enhance security measures. You've got this! By taking these actions, you're stepping up to protect your site and keep it safe from harm! 🛡️

The record
Technical detail
CVSS v3.1
9.1 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00603 · 48.2th percentile
Weakness
CWE-434 · Unrestricted Upload of File with Dangerous Type
Published
2024-03-26T20:32Z
EPSS history
Timeline
  • 26 MAR 20:32Z
    WordPress WP Githuber MD plugin <= 1.16.2 - Arbitrary File Upload vulnerability
    cvelistv5