CVE-2023-6140 Essential Real Estate < 4.4 - Subscriber+ Arbitrary File Upload

2024-01-0819:00:36

WPScan

www.cve.org

essential real estate

wordpress plugin

arbitrary file upload

remote code execution

cve-2023-6140

zip archives

AI Score

9.3

Confidence

High

EPSS

0.001

Percentile

43.5%

JSON

The Essential Real Estate WordPress plugin before 4.4.0 does not prevent users with limited privileges on the site, like subscribers, from momentarily uploading malicious PHP files disguised as ZIP archives, which may lead to remote code execution.

CNA Affected

[
  {
    "vendor": "Unknown",
    "product": "Essential Real Estate",
    "versions": [
      {
        "status": "affected",
        "versionType": "semver",
        "version": "0",
        "lessThan": "4.4.0"
      }
    ],
    "defaultStatus": "unaffected",
    "collectionURL": "https://wordpress.org/plugins"
  }
]