PT-2023-32413 · WordPress · File Manager

Dmitry Ignatyev · Published 2023-12-11 · Updated 2023-12-13 · CVE-2023-5907

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions File Manager WordPress plugin versions prior to 6.3

Description The issue allows an administrator to set a root outside of the WordPress root directory, giving access to system files and directories even in a multisite setup, where site administrators should not be allowed to modify the site's files.

Recommendations For versions prior to 6.3, update to version 6.3 or later to resolve the issue. As a temporary workaround, consider restricting access to the file manager's root directory to prevent administrators from setting a root outside of the WordPress root directory.

Exploit

Fix

Files Accessible to External Parties

Weakness Enumeration

CWE-552

Related Identifiers

CVE-2023-5907

Affected Products

File Manager

References · 6

• 🔥 https://wpscan.com/vulnerability/f250226f-4a05-4d75-93c4-5444a4ce919e · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-5907 · Security Note
• https://osv.dev/vulnerability/CVE-2023-5907 · Vendor Advisory
• https://t.me/cvenotify/63232 · Telegram Post
• https://twitter.com/CVEnew/status/1734296416166556145 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1734328498993406064 · Twitter Post