WordPress Download Monitor Plugin <= 4.8.3 is vulnerable to Arbitrary File Upload
CVE-2023-34007

9.9CRITICAL

Key Information:

Vendor

WordPress
Status
Download Monitor
Vendor
CVE Published:
20 December 2023

What is CVE-2023-34007?

The WPChill Download Monitor plugin allows for unauthorized upload of potentially harmful files. This vulnerability can be exploited by attackers to upload arbitrary files, which may lead to unauthorized execution of code and compromise the site’s security. Affected versions include all prior to 4.8.3, posing risks to any installations using the plugin.

Affected Version(s)

Download Monitor <= 4.8.3

References

https://patchstack.com/database/vulnerability/download-mo...
vdb-entry

CVSS V3.1

Score:
9.9
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Tien Nguyen Anh (Patchstack Alliance)
.