Vulnerability Details CVE-2023-4836
The WordPress File Sharing Plugin WordPress plugin before 2.0.5 does not check authorization before displaying files and folders, allowing users to gain access to those filed by manipulating IDs which can easily be brute forced
Exploit prediction scoring system (EPSS) score
EPSS Score 0.003
EPSS Ranking 50.7%
CVSS Severity
CVSS v3 Score 4.3
References
- https://research.cleantalk.org/cve-2023-4836-user-private-files-idor-to-sensitive-data-and-private-files-exposure-leak-of-info-poc
- https://wpscan.com/vulnerability/c17f2534-d791-4fe3-b45b-875777585dc6
- https://research.cleantalk.org/cve-2023-4836-user-private-files-idor-to-sensitive-data-and-private-files-exposure-leak-of-info-poc
- https://wpscan.com/vulnerability/c17f2534-d791-4fe3-b45b-875777585dc6
- https://wpscan.com/vulnerability/c17f2534-d791-4fe3-b45b-875777585dc6
Products affected by CVE-2023-4836
-
cpe:2.3:a:userprivatefiles:wordpress_file_sharing_plugin:1.0.7
-
cpe:2.3:a:userprivatefiles:wordpress_file_sharing_plugin:1.0.8
-
cpe:2.3:a:userprivatefiles:wordpress_file_sharing_plugin:1.0.9
-
cpe:2.3:a:userprivatefiles:wordpress_file_sharing_plugin:1.1.0
-
cpe:2.3:a:userprivatefiles:wordpress_file_sharing_plugin:1.1.1
-
cpe:2.3:a:userprivatefiles:wordpress_file_sharing_plugin:1.1.2
-
cpe:2.3:a:userprivatefiles:wordpress_file_sharing_plugin:1.1.3
-
cpe:2.3:a:userprivatefiles:wordpress_file_sharing_plugin:2.0.1
-
cpe:2.3:a:userprivatefiles:wordpress_file_sharing_plugin:2.0.2
-
cpe:2.3:a:userprivatefiles:wordpress_file_sharing_plugin:2.0.3
-
cpe:2.3:a:userprivatefiles:wordpress_file_sharing_plugin:2.0.4