CVE-2023-0477: Auto Featured Image < 3.9.16 - Author+ Arbitrary File Upload
The Auto Featured Image (Auto Post Thumbnail) WordPress plugin before 3.9.16 includes an AJAX endpoint that allows any user with at least Author privileges to upload arbitrary files, such as PHP files. This is caused by incorrect file extension validation.
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID CVE-2023-0477?
The vulnerability ID CVE-2023-0477 refers to a security vulnerability found in the Auto Featured Image (Auto Post Thumbnail) WordPress plugin before version 3.9.16.
What is the severity of CVE-2023-0477?
The severity of CVE-2023-0477 is high, with a severity value of 8.8.
What is the impact of CVE-2023-0477?
The impact of CVE-2023-0477 is that any user with at least Author privileges can upload arbitrary files, such as PHP files, due to incorrect file extension validation.
How can I fix CVE-2023-0477?
To fix CVE-2023-0477, you should update to the latest version of the Auto Featured Image (Auto Post Thumbnail) WordPress plugin, version 3.9.16 or higher.
Where can I find more information about CVE-2023-0477?
You can find more information about CVE-2023-0477 at the following reference: [https://wpscan.com/vulnerability/e5ef74a2-e04a-4a14-bd0e-d6910cd1c4b4]