Import XML and RSS Feeds < 2.1.4 - Admin+ Arbitrary File Upload
CVE-2023-4300

7.2HIGH

Key Information:

Vendor

Wordpress
Status
Import Xml And Rss Feeds
Vendor
CVE Published:
25 September 2023

Badges

👾 Exploit Exists🟡 Public PoC🟣 EPSS 11%

What is CVE-2023-4300?

The Import XML and RSS Feeds plugin for WordPress before version 2.1.4 is susceptible to a vulnerability that allows an attacker to upload files without proper extension filtering. This flaw could enable the execution of malicious PHP code, resulting in unauthorized control over the affected WordPress site. Site administrators are urged to upgrade to the latest version to mitigate this risk.

Affected Version(s)

Import XML and RSS Feeds 0 < 2.1.4

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2023-4300 - Proof of Concept

References

https://wpscan.com/vulnerability/d4220025-2272-4d5f-9703-...
exploitvdb-entrytechnical-description

EPSS Score

11% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
7.2
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Jonatas Souza Villa Flor
WPScan
.