CVE-2023-4536

The My Account Page Editor WordPress plugin before 1.3.2 does not validate the profile picture to be uploaded, allowing any authenticated users, such as subscriber to upload arbitrary files to the server, leading to RCE...

Code injection

The My Account Page Editor WordPress plugin before 1.3.2 does not validate the profile picture to be uploaded, allowing any authenticated users, such as subscriber to upload arbitrary files to the server, leading to RCE...

CVE-2023-4536 My Account Page Editor < 1.3.2 - Subscriber+ Arbitrary File Upload

The My Account Page Editor WordPress plugin before 1.3.2 does not validate the profile picture to be uploaded, allowing any authenticated users, such as subscriber to upload arbitrary files to the server, leading to RCE...

CVE-2023-4536

CVE-2023-4536 concerns the WordPress plugin My Account Page Editor (pre-1.3.2). The issue is a missing validation of the uploaded profile picture, enabling any authenticated user (e.g., a subscriber) to upload arbitrary files to the server, which can lead to remote code execution (RCE). The root ...

PT-2024-13240 · WordPress · My Account Page Editor

Name of the Vulnerable Software and Affected Versions: My Account Page Editor WordPress plugin versions prior to 1.3.2 Description: The issue allows any authenticated users to upload arbitrary files to the server, leading to remote code execution RCE. This is due to the lack of validation for the...

CVE-2023-4536: Unrestricted Upload of File with Dangerous Type

The My Account Page Editor WordPress plugin before 1.3.2 does not validate the profile picture to be uploaded, allowing any authenticated users, such as subscriber to upload arbitrary files to the server, leading to RCE...