ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode

CVE-2023-0477

PoC —
CVSS 3.1
8.8 high
EPSS
2%p75
Published
()
Modified
Description

The Auto Featured Image (Auto Post Thumbnail) WordPress plugin before 3.9.16 includes an AJAX endpoint that allows any user with at least Author privileges to upload arbitrary files, such as PHP files. This is caused by incorrect file extension validation.

Vendors
cm-wp
Products
auto featured image
Ecosystems
WordPress
Weakness
CWE-434
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD CVE.org GitHub PoCs EPSS (1.6%)

In the news

No ingested article mentions this CVE yet.