CVE-2023-5860
Last modified
CVE-2023-5860 is a high-severity vulnerability rated 7.2/10 on the CVSS scale. The Icons Font Loader plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the upload function in all versions up to, and including, 1.1.2. This makes it possible for authenticated attackers, with administrator-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.. EPSS estimates a 1.02% chance of exploitation in the next 30 days.
Description
The Icons Font Loader plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the upload function in all versions up to, and including, 1.1.2. This makes it possible for authenticated attackers, with administrator-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
Metrics
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Bplugins | Icons Font Loader | < 1.1.3 |
References
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2023-5860?
How severe is CVE-2023-5860?
How do I fix CVE-2023-5860?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2023
- CVE-2023-5854Use after free in Profiles in Google Chrome prior to 119.0.6…8.8
- CVE-2023-5855Use after free in Reading Mode in Google Chrome prior to 119…8.8
- CVE-2023-5856Use after free in Side Panel in Google Chrome prior to 119.0…8.8
- CVE-2023-5857Inappropriate implementation in Downloads in Google Chrome p…8.8
- CVE-2023-5858Inappropriate implementation in WebApp Provider in Google Ch…4.3
- CVE-2023-5859Incorrect security UI in Picture In Picture in Google Chrome…4.3
- CVE-2023-5861Cross-site Scripting (XSS) - Stored in GitHub repository mic…4.8
- CVE-2023-5862Missing Authorization in GitHub repository hamza417/inure pr…3.3
- CVE-2023-5863Cross-site Scripting (XSS) - Reflected in GitHub repository …6.1
- CVE-2023-5864Cross-site Scripting (XSS) - Stored in GitHub repository tho…4.8
- CVE-2023-5865Insufficient Session Expiration in GitHub repository thorste…9.8
- CVE-2023-5866Sensitive Cookie in HTTPS Session Without 'Secure' Attribute…5.7
Are you affected by CVE-2023-5860?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST