PT-2023-16184 · WordPress · Correos Oficial

Andrea Iodice · Published 2023-02-27 · Updated 2025-03-10 · CVE-2023-0331

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Correos Oficial WordPress plugin versions 1.2.0.2 and earlier

Description The issue allows unauthenticated attackers to download arbitrary files from the server due to a lack of authorization check and user input validation when generating a file path.

Recommendations For Correos Oficial WordPress plugin versions 1.2.0.2 and earlier, update to a version that includes the necessary authorization checks and input validation to prevent arbitrary file downloads. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Related Identifiers

CVE-2023-0331

Affected Products

Correos Oficial

References · 5

• 🔥 https://wpscan.com/vulnerability/1b4dbaf3-1364-4103-9a7b-b5a1355c685b · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-0331 · Security Note
• https://osv.dev/vulnerability/CVE-2023-0331 · Vendor Advisory
• https://t.me/cvenotify/114114 · Telegram Post
• https://t.me/cvenotify/45497 · Telegram Post