CVE-2023-5907

🗓️ 11 Dec 2023 19:22:37Reported by WPScanType

cve🔗 web.nvd.nist.gov👁 39 Views🌐 WEB

The File Manager WordPress plugin before 6.3 allows unauthorized access to system files and directories outside WordPress root

Reporter	Title	Published	Views	Family All 12
Circl	CVE-2023-5907	1 Jan 202414:31	–	circl
CNNVD	WordPress Plugin File Manager Security Vulnerability	11 Dec 202300:00	–	cnnvd
Cvelist	CVE-2023-5907 File Manager < 6.3 - Admin+ Arbitrary OS File/Folder Access + Path Traversal	11 Dec 202319:22	–	cvelist
NVD	CVE-2023-5907	11 Dec 202320:15	–	nvd
Patchstack	WordPress Bit File Manager Plugin < 6.3 is vulnerable to Path Traversal	19 Dec 202300:00	–	patchstack
Prion	Design/Logic Flaw	11 Dec 202320:15	–	prion
Positive Technologies	PT-2023-32413 · WordPress · File Manager	11 Dec 202300:00	–	ptsecurity
RedhatCVE	CVE-2023-5907	23 May 202504:33	–	redhatcve
Vulnrichment	CVE-2023-5907 File Manager < 6.3 - Admin+ Arbitrary OS File/Folder Access + Path Traversal	11 Dec 202319:22	–	vulnrichment
Wordfence Blog	Wordfence Intelligence Weekly WordPress Vulnerability Report (November 20, 2023 to November 26, 2023)	30 Nov 202315:31	–	wordfence

NVD

Vulners

Node

bitapps file_managerRange<6.3wordpress

[
  {
    "vendor": "Unknown",
    "product": "File Manager",
    "versions": [
      {
        "status": "affected",
        "versionType": "semver",
        "version": "0",
        "lessThan": "6.3"
      }
    ],
    "defaultStatus": "unaffected",
    "collectionURL": "https://wordpress.org/plugins"
  }
]

Source	Link
wpscan	www.wpscan.com/vulnerability/f250226f-4a05-4d75-93c4-5444a4ce919e

Parameter	Position	Path	Description	CWE
Root Folder Path	request body	/wordpress/wp-admin/admin.php?page=file-manager-settings	Root Folder Path input allows path traversal to outside WordPress root, enabling access to system files.	CWE-552

27 May 2025 15:15Current

6.3Medium risk

Vulners AI Score6.3

CVSS 3.16.5

EPSS0.0036

SSVC

CWE-552