CVE-2023-4019
Last modified
CVE-2023-4019 is a high-severity vulnerability rated 8.8/10 on the CVSS scale. The Media from FTP WordPress plugin before 11.17 does not properly limit who can use the plugin, which may allow users with author+ privileges to move files around, like wp-config.php, which may lead to RCE in some cases.. EPSS estimates a 0.65% chance of exploitation in the next 30 days.
Description
The Media from FTP WordPress plugin before 11.17 does not properly limit who can use the plugin, which may allow users with author+ privileges to move files around, like wp-config.php, which may lead to RCE in some cases.
Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Riverforest-Wp | Media From Ftp | < 11.17 |
References
- https://wpscan.com/vulnerability/0d323b07-c6e7-4aba-85bc-64659ad0c85dExploit, Third Party Advisory
- https://wpscan.com/vulnerability/0d323b07-c6e7-4aba-85bc-64659ad0c85dExploit, Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2023-4019?
How severe is CVE-2023-4019?
How do I fix CVE-2023-4019?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2023
- CVE-2023-40183DataEase is an open source data visualization and analysis t…5.3
- CVE-2023-40184xrdp is an open source remote desktop protocol (RDP) server.…6.5
- CVE-2023-40185shescape is simple shell escape library for JavaScript. This…8.6
- CVE-2023-40186FreeRDP is a free implementation of the Remote Desktop Proto…9.8
- CVE-2023-40187FreeRDP is a free implementation of the Remote Desktop Proto…9.8
- CVE-2023-40188FreeRDP is a free implementation of the Remote Desktop Proto…9.1
- CVE-2023-40191Reflected cross-site scripting (XSS) vulnerability in the in…6.1
- CVE-2023-40193Deco M4 firmware versions prior to 'Deco M4(JP)_V2_1.5.8 Bui…8
- CVE-2023-40194An arbitrary file creation vulnerability exists in the Javas…8.8
- CVE-2023-40195Deserialization of Untrusted Data, Inclusion of Functionalit…8.8
- CVE-2023-40196Unauth. Reflected Cross-Site Scripting (XSS) vulnerability i…6.1
- CVE-2023-40197Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulne…5.4
Are you affected by CVE-2023-4019?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST