PT-2023-30719 · WordPress · Shared Files

Zeyad Alshahrani · Published 2023-10-16 · Updated 2023-10-20 · CVE-2023-4819

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions The Shared Files WordPress plugin versions prior to 1.7.6

Description The issue arises from the plugin not returning the correct Content-Type header for uploaded files, allowing an attacker to upload files with allowed extensions that contain malicious scripts.

Recommendations For versions prior to 1.7.6, update to version 1.7.6 or later to resolve the issue. As a temporary workaround, consider restricting file uploads to trusted users or disabling the file upload feature until the update is applied.

Exploit

Fix

Related Identifiers

CVE-2023-4819

Affected Products

Shared Files

References · 5

• 🔥 https://wpscan.com/vulnerability/4423b023-cf4a-46cb-b314-7a09ac08b29a · Exploit
• https://osv.dev/vulnerability/CVE-2023-4819 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-4819 · Security Note
• https://twitter.com/VulmonFeeds/status/1714051980052631663 · Twitter Post
• https://twitter.com/CVEnew/status/1714006548643516729 · Twitter Post