PT-2024-14835 · WordPress · Code Explorer

Dmitry Ignatyev · Published 2024-10-30 · Updated 2024-11-07 · CVE-2023-5816

Positive Technologies (AI Summary)

CVSS v3.1

4.9

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Code Explorer plugin for WordPress versions up to, and including, 1.4.5

Description The Code Explorer plugin for WordPress is vulnerable to arbitrary external file reading due to the lack of restriction on accessing files outside of the WordPress instance. This allows authenticated attackers with administrator-level access to read files outside of the WordPress instance.

Recommendations For versions up to, and including, 1.4.5, update to the latest version available to protect your site from this vulnerability. As a temporary workaround, consider restricting access to sensitive files and directories until the update is applied.

Fix

Weakness Enumeration

CWE-73

Related Identifiers

CVE-2023-5816

Affected Products

Code Explorer

References · 10

• https://osv.dev/vulnerability/CVE-2023-5816 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-5816 · Security Note
• https://wordfence.com/threat-intel/vulnerabilities/id/42ecc4e5-d660-472f-823d-a29b84cdf041?source=cve · Note
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3234408%40code-explorer&new=3234408%40code-explorer&sfp_email=&sfph_mail= · Note
• https://t.me/cvedetector/9396 · Telegram Post
• https://wordpress.org/plugins/code-explorer/#developers · Note
• https://twitter.com/transilienceai/status/1852419109658714539 · Twitter Post
• https://twitter.com/transilienceai/status/1852419101727306115 · Twitter Post
• https://t.me/cvenotify/99987 · Telegram Post
• https://twitter.com/UndercodeNews/status/1854368537160106422 · Twitter Post