Vulnerability · Published Jun 9, 2023 · Assigned by Wordfence
CVE-2023-2688WordPress File Upload / WordPress File Upload Pro <= 4.19.1 - Authenticated (Administrator+) Path Traversal
Medium 4.9
In plain English
A medium-severity path traversal in Iptanus File Upload from nickboss. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.7% (higher than 78% of all known vulnerabilities).
Severity (CVSS 3.1)4.9Medium
Exploit odds (30 days)1.7%top 22.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
The WordPress File Upload and WordPress File Upload Pro plugins for WordPress are vulnerable to Path Traversal in versions up to, and including, 4.19.1 via the vulnerable parameter wfu_newpath. This allows administrator-level attackers to move files uploaded with the plugin (located in wp-content/uploads by default) outside of the web root.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| nickboss | Iptanus File Upload | 0 – through 4.19.1 |
| Unknown | WordPress File Upload Pro | 0 – through 4.19.1 |
Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N