CVE-2023-7061: Advanced File Manager Shortcode <= 2.5.3 - Authenticated (Contributor+) Arbitrary File Upload
The Advanced File Manager Shortcodes plugin for WordPress is vulnerable to arbitrary file uploads in all versions up to, and including, 2.5.3. This makes it possible for authenticated attackers with contributor access or above to upload arbitrary files on the affected site's server which may make remote code execution possible.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2023-7061?
CVE-2023-7061 is a critical vulnerability allowing arbitrary file uploads, which can lead to severe security risks if exploited.
How do I fix CVE-2023-7061?
To fix CVE-2023-7061, update the Advanced File Manager Shortcodes plugin to version 2.5.4 or later.
Who is impacted by CVE-2023-7061?
Authenticated users with contributor access or higher on a WordPress site using the affected plugin versions are impacted by CVE-2023-7061.
What version of the Advanced File Manager Shortcodes is vulnerable to CVE-2023-7061?
All versions up to and including 2.5.3 of the Advanced File Manager Shortcodes plugin are vulnerable to CVE-2023-7061.
What kind of attacks can be performed due to CVE-2023-7061?
CVE-2023-7061 allows attackers to upload arbitrary files, potentially leading to remote code execution and complete server compromise.