CVE-2023-4861

2023-10-1620:15:17

[email protected]

web.nvd.nist.gov

cve-2023-4861

file manager pro

wordpress plugin

remote code execution

arbitrary file upload

nvd

7.2 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

0.001 Low

EPSS

Percentile

43.7%

JSON

The File Manager Pro WordPress plugin before 1.8.1 allows admin users to upload arbitrary files, even in environments where such a user should not be able to gain full control of the server, such as a multisite installation. This leads to remote code execution.

Affected configurations

Vulners

NVD

Node

filemanagerprofile_manager_proRange<1.8.1

VendorProductVersionCPE
filemanagerprofile_manager_pro*cpe:2.3:a:filemanagerpro:file_manager_pro:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
filemanagerpro	file_manager_pro	*	cpe:2.3:a:filemanagerpro:file_manager_pro::::::::

CNA Affected

[
  {
    "vendor": "Unknown",
    "product": "File Manager Pro",
    "versions": [
      {
        "status": "affected",
        "versionType": "custom",
        "version": "0",
        "lessThan": "1.8.1"
      }
    ],
    "defaultStatus": "unaffected",
    "collectionURL": "https://wordpress.org/plugins"
  }
]