CVE-2023-0331

PoC —

CVSS 3.1

7.5 high

EPSS

<1%p56

Published

Feb 27, 2023 (Feb 27, 2023)

Modified

Jun 17, 2026

Description

The Correos Oficial WordPress plugin through 1.2.0.2 does not have an authorization check user input validation when generating a file path, allowing unauthenticated attackers to download arbitrary files from the server.

Vendors: correos
Products: correos oficial
Ecosystems: WordPress
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

NVD CVE.org GitHub PoCs EPSS (0.8%)

In the news0 stories

No ingested article mentions this CVE yet.