CVE-2023-2068: advancedfilemanager file_manager_advanced_shortcode Code Injection

Vulnerability summary

CVE-2023-2068 is a critical (CVSS 9.8) Code Injection vulnerability in advancedfilemanager file_manager_advanced_shortcode. EPSS estimates a 39.62% chance of exploitation in the next 30 days, higher than 98.6% of scored vulnerabilities. 4 public exploits are recorded.

Timeline

1. 27-06-2023
   PublishedVulnerability first disclosed.
2. 13-02-2025
   Last modifiedVulnerability information updated.

Description

The File Manager Advanced Shortcode WordPress plugin through 2.3.2 does not adequately prevent uploading files with disallowed MIME types when using the shortcode. This leads to RCE in cases where the allowed MIME type list does not include PHP files. In the worst case, this is available to unauthenticated users.

• CWE-94Improper Control of Generation of Code ('Code Injection')The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.