CVE-2023-7062CWE-538

Advanced File Manager Shortcodes <= 2.4 - Authenticated (Contributor+) Directory Traversal

High · published July 10, 2024

CVSS v3.1
8.8
EPSS
1%
Percentile
53.2
In the wild
Unconfirmed
What it is

The Advanced File Manager Shortcodes plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.4. This makes it possible for attackers with contributor access or higher to read the contents of arbitrary files on the server, which can contain sensitive information.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00716 · 53.2th percentile
Weakness
CWE-538 · Insertion of Sensitive Information into Externally-Accessible File or Directory
Published
2024-07-10T02:02Z
EPSS history
Timeline
  • 10 JUL 02:02Z
    Advanced File Manager Shortcodes <= 2.4 - Authenticated (Contributor+) Directory Traversal
    cvelistv5