Strix
26.1K

CVE-2023-2068

CRITICALCVSS 9.8/10EPSS 39.62%

Last modified

CVE-2023-2068 is a critical-severity vulnerability rated 9.8/10 on the CVSS scale. The File Manager Advanced Shortcode WordPress plugin through 2.3.2 does not adequately prevent uploading files with disallowed MIME types when using the shortcode. This leads to RCE in cases where the allowed MIME type list does not include PHP files. EPSS estimates a 39.62% chance of exploitation in the next 30 days.

Description

The File Manager Advanced Shortcode WordPress plugin through 2.3.2 does not adequately prevent uploading files with disallowed MIME types when using the shortcode. This leads to RCE in cases where the allowed MIME type list does not include PHP files. In the worst case, this is available to unauthenticated users.

Metrics

CVSS 3.1
9.8/10

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Probability
39.62%

98.4th percentile

Probability of exploitation in the next 30 days. Learn more

Affected Software

VendorProductVersions
AdvancedfilemanagerFile Manager Advanced Shortcode<= 2.3.2

References

Timeline

Published
Last Modified
Status
Modified

Frequently Asked Questions

What is CVE-2023-2068?
The File Manager Advanced Shortcode WordPress plugin through 2.3.2 does not adequately prevent uploading files with disallowed MIME types when using the shortcode. This leads to RCE in cases where the allowed MIME type list does not include PHP files. In the worst case, this is available to unauthenticated users.
How severe is CVE-2023-2068?
CVE-2023-2068 has a CVSS score of 9.8/10 (CRITICAL severity). The EPSS model estimates a 39.62% probability of exploitation in the next 30 days.
How do I fix CVE-2023-2068?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2023-2068?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST