PT-2024-14887

CVE-2023-6140

Published

2024-01-08

Updated

2024-09-04

Description by

CVSS 3.1

8.8

High

MetricsAV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions The Essential Real Estate WordPress plugin versions prior to 4.4.0

Description The issue allows users with limited privileges, such as subscribers, to upload malicious PHP files disguised as ZIP archives, potentially leading to remote code execution.

Recommendations For versions prior to 4.4.0, update to version 4.4.0 or later to resolve the issue. As a temporary workaround, consider restricting file upload capabilities for users with limited privileges until the update can be applied.

Exploitability

Exploit

Fix

Impacts

Researchers

Krzysztof Zając

Marc Montpas

Vendors

Affected products

Weakness enumeration

CWE-434: Unrestricted Upload of File with Dangerous Type

Related identifiers