PT-2023-21181 · WordPress · Upload Resume Wordpress Plugin

Yakshita Sharma · Published 2023-06-19 · Updated 2024-12-12 · CVE-2023-2751

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Upload Resume WordPress plugin versions 1.2.0 and earlier

Description The issue allows unauthenticated visitors to upload arbitrary media files to the site due to a lack of validation of the captcha parameter when uploading a resume via the resume upload form shortcode.

Recommendations For Upload Resume WordPress plugin versions 1.2.0 and earlier, as a temporary workaround, consider disabling the resume upload form shortcode until a patch is available. Restrict access to the media upload functionality to minimize the risk of exploitation. Avoid using the captcha parameter in the affected shortcode until the issue is resolved.

Exploit

Fix

Related Identifiers

CVE-2023-2751

Affected Products

Upload Resume Wordpress Plugin

References · 5

• 🔥 https://wpscan.com/vulnerability/1b0fe0ac-d0d1-473d-af5b-dad6217933d4 · Exploit
• https://osv.dev/vulnerability/CVE-2023-2751 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-2751 · Security Note
• https://t.me/cvenotify/53116 · Telegram Post
• https://t.me/cvenotify/52633 · Telegram Post