CVE-2023-4238
Miniorange Prevent Files \/ Folders Access ≤ 2.5.2
Raw vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:HCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2023-4238 is a high-severity an unspecified weakness vulnerability in Miniorange Prevent Files \/ Folders Access. Its CVSS base score is 7.2 (High).
Operationally, ranked in the top 25% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
The Prevent files / folders access WordPress plugin before version 2.5.2 contains an arbitrary file upload vulnerability because it performs no validation on files submitted for upload. This affects any site running the vulnerable plugin and allows an attacker to place files such as PHP scripts directly on the server.
An attacker with high privileges, typically an authenticated administrator, can exploit the flaw over the network with low attack complexity. Successful exploitation grants the ability to upload and execute arbitrary code, resulting in full confidentiality, integrity, and availability impact on the affected WordPress installation.
The referenced WPScan advisory identifies the issue in the plugin and indicates that the problem is resolved by updating to version 2.5.2 or later. The EPSS score reached a peak of 0.2819 before receding to its current value of 0.2467, indicating moderate and sustained exploitation interest after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-54110
Vulnerability Data
The Prevent files / folders access WordPress plugin before 2.5.2 does not validate files to be uploaded, which could allow attackers to upload arbitrary files such as PHP on the server.
- CWE(s)
Related Threats
CVEs Like This One
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.