CVE-2023-6635
Published: 05 February 2024
Summary
CVE-2023-6635 is a high-severity Unrestricted Upload of File with Dangerous Type (CWE-434) vulnerability in Extendify Editorskit. Its CVSS base score is 7.2 (High).
Operationally, ranked in the top 8.0% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
The EditorsKit plugin for WordPress is vulnerable to arbitrary file uploads because the import_styles function lacks file type validation in all versions through 1.40.3. The flaw is tracked as CWE-434 and carries a CVSS 3.1 score of 7.2, reflecting network-accessible exploitation that requires administrator privileges but needs no user interaction.
An authenticated attacker with administrator rights can invoke the affected REST endpoint to upload files of any type to the server. Successful exploitation can result in arbitrary code execution on the host, giving the attacker full control over the WordPress site and its underlying operating system.
The referenced Wordfence advisory and WordPress Trac changeset 3010794 document the availability of a patch that adds the missing validation; site owners are expected to update the EditorsKit plugin to a version newer than 1.40.3. The associated EPSS scores have remained essentially flat near 0.08 since disclosure, indicating no material increase in observed exploitation interest.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-58858
Vulnerability details
The EditorsKit plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation on the 'import_styles' function in versions up to, and including, 1.40.3. This makes it possible for authenticated attackers with administrator-level capabilities or above,…
more
to upload arbitrary files on the affected site's server which may make remote code execution possible.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Requiring identifiable owners for portable devices reduces the attack surface for unrestricted uploads of dangerous file types via anonymous media.
Dangerous file uploads can be detonated in the chamber to determine malice before any production write or execution occurs.
Prevents unrestricted writing of arbitrary or malicious firmware by keeping hardware write-protect enabled except under tightly controlled manual procedures.
Scans files from external sources on download/open/execute, blocking unrestricted uploads of dangerous file types.