PT-2023-30025 · WordPress · Enable Media Replace

0Xp1P3 + 1 · Publicado 2023-10-16 · Atualizado 2023-10-20 · CVE-2023-4643

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Enable Media Replace WordPress plugin versions prior to 4.1.3

Description The issue allows Author+ users to perform PHP Object Injection when a suitable gadget is present on the blog, due to the unserialize of user input via the Remove Background feature.

Recommendations For versions prior to 4.1.3, update to version 4.1.3 or later to resolve the issue. As a temporary workaround, consider restricting access to the Remove Background feature for Author+ users until the update is applied.

Exploit

Correção

Identificadores relacionados

CVE-2023-4643

Produtos afetados

Enable Media Replace

Referências · 5

• 🔥 https://wpscan.com/vulnerability/d9125604-2236-435c-a67c-07951a1fc5b1 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-4643 · Nota de Segurança
• https://twitter.com/CVEnew/status/1714006544952488243 · Publicação no Twitter
• https://twitter.com/VulmonFeeds/status/1714060374775886079 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2023-4643 · Aviso do Fabricante