Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
wpvulndbDmitriiWPVDB-ID:D59E6EAC-3EBF-40E0-800C-8CBEF345423F
HistoryAug 30, 2023 - 12:00 a.m.

FileOrganizer < 1.0.3 - Admin+ Arbitrary File Access

2023-08-3000:00:00
Dmitrii
wpscan.com
fileorganizer
arbitrary file access
multisite instance
admin
server control

0.001 Low

EPSS

Percentile

19.3%

JSON

Description The plugin does not restrict functionality on multisite instances, allowing site admins to gain full control over the server.

PoC

On a multisite instance, log in as an admin. Click on File Organizer in the sidebar. The UI gives full control to the files on the server, despite not being a super admin.

CPENameOperatorVersion
eq1.0.3

Related

cvelist 1
wpexploit 1
cve 1
openvas 1
prion 1
nvd 1
wordfence 1
cvelist
cvelist
CVE-2023-3664 FileOrganizer <= 1.0.2 - Admin+ Arbitrary File Access
2023-09-25 15:56:55
wpexploit
wpexploit
FileOrganizer < 1.0.3 - Admin+ Arbitrary File Access
2023-08-30 00:00:00
cve
cve
CVE-2023-3664
2023-09-25 16:15:14
openvas
openvas
WordPress FileOrganizer Plugin < 1.0.3 Improper Access Control Vulnerability
2023-09-26 00:00:00
prion
prion
Code injection
2023-09-25 16:15:00
nvd
nvd
CVE-2023-3664
2023-09-25 16:15:14
wordfence
wordfence
Wordfence Intelligence Weekly WordPress Vulnerability Report (August 28, 2023 to September 3, 2023)
2023-09-07 12:51:06

0.001 Low

EPSS

Percentile

19.3%

JSON
Related for WPVDB-ID:D59E6EAC-3EBF-40E0-800C-8CBEF345423F
cvelist1wpexploit1cve1openvas1prion1nvd1wordfence1