Directory Traversal Vulnerability in Icegram Express Plugin for WordPress
CVE-2023-5414
9.1CRITICAL
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 20 October 2023
What is CVE-2023-5414?
The Icegram Express plugin for WordPress is susceptible to a directory traversal vulnerability through its show_es_logs function. This flaw enables attackers with administrator-level access to navigate the server's file system and read arbitrary files, potentially exposing sensitive data from other sites, particularly in shared hosting scenarios. Organizations using this plugin should take immediate action to mitigate associated risks.
Affected Version(s)
Icegram Express – Email Marketing, Newsletters and Automation for WordPress & WooCommerce * <= 5.6.23