CVE-2023-6140: Essential Real Estate < 4.4 - Subscriber+ Arbitrary File Upload
The Essential Real Estate WordPress plugin before 4.4.0 does not prevent users with limited privileges on the site, like subscribers, from momentarily uploading malicious PHP files disguised as ZIP archives, which may lead to remote code execution.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2023-6140?
CVE-2023-6140 is classified as a high severity vulnerability due to the potential for remote code execution.
How do I fix CVE-2023-6140?
To fix CVE-2023-6140, update the Essential Real Estate WordPress plugin to version 4.4.0 or later.
Who is affected by CVE-2023-6140?
Users of the Essential Real Estate WordPress plugin version prior to 4.4.0 are affected by CVE-2023-6140.
What type of attack can occur due to CVE-2023-6140?
CVE-2023-6140 allows attackers to upload malicious PHP files that could lead to remote code execution.
What is the exploit method for CVE-2023-6140?
CVE-2023-6140 can be exploited by limited privilege users uploading compromised ZIP files.