1. Home
  2. CVE Database
  3. CVE-2023-2688
MEDIUM · 4.9

CVE-2023-2688

The WordPress File Upload and WordPress File Upload Pro plugins for WordPress are vulnerable to Path Traversal in versions up to, and including, 4.19.1 via the vulnerable parameter wfu_newpath. This a...

Vulnerability Description

The WordPress File Upload and WordPress File Upload Pro plugins for WordPress are vulnerable to Path Traversal in versions up to, and including, 4.19.1 via the vulnerable parameter wfu_newpath. This allows administrator-level attackers to move files uploaded with the plugin (located in wp-content/uploads by default) outside of the web root.

CVSS Score

4.9

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
HIGH
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
NONE
Availability
NONE

Affected Products

VendorProductVersions
IptanusWordpress File Upload<= 4.19.1
IptanusWordpress File Upload Pro<= 4.19.1

Related Weaknesses (CWE)

CWE-22

References

FAQ

What is CVE-2023-2688?

CVE-2023-2688 is a vulnerability with a CVSS score of 4.9 (MEDIUM). The WordPress File Upload and WordPress File Upload Pro plugins for WordPress are vulnerable to Path Traversal in versions up to, and including, 4.19.1 via the vulnerable parameter wfu_newpath. This a...

How severe is CVE-2023-2688?

CVE-2023-2688 has been rated MEDIUM with a CVSS base score of 4.9/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2023-2688?

Check the references section above for vendor advisories and patch information. Affected products include: Iptanus Wordpress File Upload, Iptanus Wordpress File Upload Pro.