CVE-2023-2068: File Manager Advanced Shortcode <= 2.3.2 - Unauthenticated Remote Code Execution through shortcode
The File Manager Advanced Shortcode WordPress plugin through 2.3.2 does not adequately prevent uploading files with disallowed MIME types when using the shortcode. This leads to RCE in cases where the allowed MIME type list does not include PHP files. In the worst case, this is available to unauthenticated users.
Credit
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2023-2068?
CVE-2023-2068 is considered a high severity vulnerability due to its potential for remote code execution.
How do I fix CVE-2023-2068?
To fix CVE-2023-2068, update the File Manager Advanced Shortcode plugin to version 2.3.3 or later.
What type of vulnerability is CVE-2023-2068?
CVE-2023-2068 is a remote code execution vulnerability stemming from insufficient file upload validation.
Who is affected by CVE-2023-2068?
Users of the File Manager Advanced Shortcode WordPress plugin version 2.3.2 and earlier are affected by CVE-2023-2068.
Can CVE-2023-2068 be exploited through a shortcode?
Yes, CVE-2023-2068 can be exploited through a shortcode that fails to restrict disallowed MIME types.