CVE-2023-2278: WP Directory Kit <= 1.1.9 - Unauthenticated Local File Inclusion via wdk_public_action
The WP Directory Kit plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 1.1.9 via the 'wdkpublicaction' function. This allows unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2023-2278?
CVE-2023-2278 is rated as a critical vulnerability due to its potential for remote code execution.
How do I fix CVE-2023-2278?
To fix CVE-2023-2278, update the WP Directory Kit plugin to version 1.2.0 or later.
What versions of WP Directory Kit are affected by CVE-2023-2278?
Versions of the WP Directory Kit plugin up to and including 1.1.9 are affected by CVE-2023-2278.
What type of attack does CVE-2023-2278 allow?
CVE-2023-2278 allows unauthenticated attackers to perform Local File Inclusion, potentially executing arbitrary PHP code on the server.
Is authentication required to exploit CVE-2023-2278?
No, CVE-2023-2278 can be exploited by unauthenticated attackers, making it particularly dangerous.