CVE-2023-7201
Published: 15 April 2024
Summary
CVE-2023-7201 is a medium-severity an unspecified weakness vulnerability in Everestthemes Everest Backup. Its CVSS base score is 6.5 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Web Shell (T1505.003); ranked at the 45.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-59382
Vulnerability details
The Everest Backup WordPress plugin before 2.2.5 does not properly validate backup files to be uploaded, allowing high privilege users such as admin to upload arbitrary files on the server even when they should not be allowed to (for example…
more
in multisite setup)
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability enables authenticated high-privilege users (e.g., admins) to bypass validation and upload arbitrary PHP files, such as web shells containing code like '<?php echo system($_GET['cmd']); ?>', directly facilitating the deployment and execution of web shells for remote code execution on the server.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.