PT-2024-14887 · WordPress · Essential Real Estate

Krzysztof Zając + 1 · Published 2024-01-08 · Updated 2024-09-04 · CVE-2023-6140

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions The Essential Real Estate WordPress plugin versions prior to 4.4.0

Description The issue allows users with limited privileges, such as subscribers, to upload malicious PHP files disguised as ZIP archives, potentially leading to remote code execution.

Recommendations For versions prior to 4.4.0, update to version 4.4.0 or later to resolve the issue. As a temporary workaround, consider restricting file upload capabilities for users with limited privileges until the update can be applied.

Exploit

Fix

RCE

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2023-6140

Affected Products

Essential Real Estate

References · 5

• 🔥 https://wpscan.com/vulnerability/c837eaf3-fafd-45a2-8f5e-03afb28a765b · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-6140 · Security Note
• https://osv.dev/vulnerability/CVE-2023-6140 · Vendor Advisory
• https://twitter.com/CVEnew/status/1744453199661277293 · Twitter Post
• https://t.me/cvenotify/93215 · Telegram Post