CVE-2023-2068
CRITICALWordPress File Manager Advanced Shortcode <2.3.2 - RCE
Title source: llmDescription
The File Manager Advanced Shortcode WordPress plugin through 2.3.2 does not adequately prevent uploading files with disallowed MIME types when using the shortcode. This leads to RCE in cases where the allowed MIME type list does not include PHP files. In the worst case, this is available to unauthenticated users.
Exploits (2)
exploitdb
WORKING POC
by Mateus Machado Tesser · pythonwebappsphp
https://www.exploit-db.com/exploits/51505
metasploit
WORKING POC
EXCELLENT
rubypocphp
https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/wp_plugin_fma_shortcode_unauth_rce.rb
Scores
CVSS v3
9.8
EPSS
0.7041
EPSS Percentile
98.7%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Details
Status
published
Products (1)
advancedfilemanager/file_manager_advanced_shortcode
< 2.3.2
Published
Jun 27, 2023
Tracked Since
Feb 18, 2026