CVE-2023-2688
Last modified
CVE-2023-2688 is a medium-severity vulnerability rated 4.9/10 on the CVSS scale. The WordPress File Upload and WordPress File Upload Pro plugins for WordPress are vulnerable to Path Traversal in versions up to, and including, 4.19.1 via the vulnerable parameter wfu_newpath. This allows administrator-level attackers to move files uploaded with the plugin (located in wp-content/uploads by default) outside of the web root.. EPSS estimates a 1.74% chance of exploitation in the next 30 days.
Description
The WordPress File Upload and WordPress File Upload Pro plugins for WordPress are vulnerable to Path Traversal in versions up to, and including, 4.19.1 via the vulnerable parameter wfu_newpath. This allows administrator-level attackers to move files uploaded with the plugin (located in wp-content/uploads by default) outside of the web root.
Metrics
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Iptanus | Wordpress File Upload | <= 4.19.1 |
| Iptanus | Wordpress File Upload Pro | <= 4.19.1 |
References
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2023-2688?
How severe is CVE-2023-2688?
How do I fix CVE-2023-2688?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2023
- CVE-2023-26864SQL injection vulnerability found in PrestaShop smplredirect…9.8
- CVE-2023-26865SQL injection vulnerability found in PrestaShop bdroppy v.2.…9.8
- CVE-2023-26866GreenPacket OH736's WR-1200 Indoor Unit, OT-235 with firmwar…9.8
- CVE-2023-2687Buffer overflow in Platform CLI component in Silicon Labs Ge…3.3
- CVE-2023-26876SQL injection vulnerability found in Piwigo v.13.5.0 and bef…8.8
- CVE-2023-26877File upload vulnerability found in Softexpert Excellence Sui…6.3
- CVE-2023-2689A vulnerability classified as critical was found in SourceCo…8.8
- CVE-2023-2690A vulnerability, which was classified as critical, has been …8.8
- CVE-2023-26905An issue was discovered in Alphaware - Simple E-Commerce Sys…9.8
- CVE-2023-2691A vulnerability, which was classified as problematic, was fo…5.4
- CVE-2023-26911ASUS SetupAsusServices v1.0.5.1 in Asus Armoury Crate v5.3.4…7.8
- CVE-2023-26912Cross site scripting (XSS) vulnerability in xenv S-mall-ssm …4.8
Are you affected by CVE-2023-2688?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST