Lucene search

WordfenceCVE-2023-5860

HistoryNov 02, 2023 - 12:15 p.m.

CVE-2023-5860

2023-11-0212:15:09

CWE-434

Wordfence

web.nvd.nist.gov

wordpress

icons font loader

vulnerability

file uploads

nvd

cve-2023-5860

CVSS3

7.2

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

AI Score

7.4

Confidence

High

EPSS

0.001

Percentile

45.5%

JSON

The Icons Font Loader plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the upload function in all versions up to, and including, 1.1.2. This makes it possible for authenticated attackers, with administrator-level access and above, to upload arbitrary files on the affected site’s server which may make remote code execution possible.

Affected configurations

Nvd

Vulners

Node

bpluginsicons_font_loaderRange<1.1.3wordpress

VendorProductVersionCPE
bpluginsicons_font_loader*cpe:2.3:a:bplugins:icons_font_loader:*:*:*:*:*:wordpress:*:*

Vendor	Product	Version	CPE
bplugins	icons_font_loader	*	cpe:2.3:a:bplugins:icons_font_loader::::::wordpress::*

CNA Affected

[
  {
    "vendor": "abuhayat",
    "product": "Icons Font Loader",
    "versions": [
      {
        "version": "*",
        "status": "affected",
        "lessThanOrEqual": "1.1.2",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

References

plugins.trac.wordpress.org/changeset/2987296/icons-font-loader

www.wordfence.com/threat-intel/vulnerabilities/id/12a9fbe8-445a-478a-b6ce-cd669ccb6a2d?source=cve

CVSS3

7.2

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

AI Score

7.4

Confidence

High

EPSS

0.001

Percentile

45.5%

JSON

Related for CVE-2023-5860