CVE-2023-6140

Published Jan 8, 2024

Last updated 2 months ago

Overview

Description: The Essential Real Estate WordPress plugin before 4.4.0 does not prevent users with limited privileges on the site, like subscribers, from momentarily uploading malicious PHP files disguised as ZIP archives, which may lead to remote code execution.
Source: contact@wpscan.com
NVD status: Modified

Risk scores

CVSS 3.1

Type: Primary
Base score: 8.8
Impact score: 5.9
Exploitability score: 2.8
Vector string: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Severity: HIGH

Weaknesses

nvd@nist.gov: CWE-434

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:g5plus:essential_real_estate:*:*:*:*:*:wordpress:*:*",
            "vulnerable": true,
            "matchCriteriaId": "CB8E7130-A758-4F32-B03C-18B4B8BEB712",
            "versionEndExcluding": "4.4.0"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

References