Vulnerability · Published Nov 27, 2023 · Assigned by WPScan
CVE-2023-4297Mmm Simple File List <= 2.3 - Subscriber+ Arbitrary Directory Listing
Medium 4.3
In plain English
A medium-severity security flaw in Mmm Simple File List from Unknown. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 51% of all known vulnerabilities).
Severity (CVSS 3.1)4.3Medium
Exploit odds (30 days)0.6%top 49.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
The Mmm Simple File List WordPress plugin through 2.3 does not validate the generated path to list files from, allowing any authenticated users, such as subscribers, to list the content of arbitrary directories.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Unknown | Mmm Simple File List | 0 – through 2.3 |
References
- https://wpscan.com/vulnerability/9ff85b06-819c-459e-90a9-6151bfd70978 exploit, vdb-entry, technical-description