Vulnerability · Published Jun 27, 2023 · Assigned by WPScan
CVE-2023-2068File Manager Advanced Shortcode <= 2.3.2 - Unauthenticated Remote Code Execution through shortcode
Critical 9.8
In plain English
A critical-severity security flaw in file-manager-advanced-shortcode from Unknown. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 39.6% (higher than 99% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit.
Severity (CVSS NVD)9.8Critical
Exploit odds (30 days)39.6%top 1.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack tooling1Metasploit
Official description
The File Manager Advanced Shortcode WordPress plugin through 2.3.2 does not adequately prevent uploading files with disallowed MIME types when using the shortcode. This leads to RCE in cases where the allowed MIME type list does not include PHP files. In the worst case, this is available to unauthenticated users.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Unknown | file-manager-advanced-shortcode | 0 – through 2.3.2 |