CVE-2023-7061
Advancedfilemanager File Manager Advanced Shortcode ≤ 2.5.3
Raw vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2023-7061 is a high-severity Unrestricted Upload of File with Dangerous Type (CWE-434) vulnerability in Advancedfilemanager File Manager Advanced Shortcode. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Data Obfuscation (T1001); ranked in the top 43% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SI-3 (Malicious Code Protection) and CM-7 (Least Functionality) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
The Advanced File Manager Shortcodes plugin for WordPress is vulnerable to arbitrary file uploads in all versions up to and including 2.5.3. This flaw, tracked as CVE-2023-7061 with a CVSS v3.1 score of 8.8 and mapped to CWE-434, permits unrestricted upload of files with dangerous types due to missing validation controls in the affected component.
Authenticated attackers holding contributor access or above can exploit the issue over the network to upload arbitrary files onto the server, which may result in remote code execution and full compromise of the confidentiality, integrity, and availability of the site.
References from Wordfence and the vendor site at advancedfilemanager.com provide threat intelligence and product information for this vulnerability but do not detail specific patch versions or mitigation steps beyond the affected range. The associated EPSS score remains flat at a peak and current value of 0.1579 with no indicated trajectory of increased exploitation interest.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-59248
Vulnerability Data
The Advanced File Manager Shortcodes plugin for WordPress is vulnerable to arbitrary file uploads in all versions up to, and including, 2.5.3. This makes it possible for authenticated attackers with contributor access or above to upload arbitrary files on the…
more
affected site's server which may make remote code execution possible.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V5.1.1
Mitigating Controls (NIST 800-53 r5) AI
Malicious-code protection at entry points blocks dangerous file types from being accepted and executed.
Least functionality restricts the file types and automatic processing capabilities the system will accept.
Mobile-code controls define, authorize, and block unacceptable uploaded code before automatic processing occurs.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Hardened configuration baselines can enforce allowed file types and processing rules.
Restricting execution of unauthorized software directly blocks dangerous uploaded files from running.
Secure development practices include input validation and file-type restrictions that prevent this weakness.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.