CVE-2023-2068
CRITICALWordPress File Manager Advanced Shortcode <2.3.2 - RCE
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2023-2068.
PoCs published by Mateus Machado Tesser, including Metasploit module exploits/multi/http/wp_plugin_fma_shortcode_unauth_rce.
AI-analyzed exploit summary This exploit leverages an unauthenticated RCE vulnerability in File Manager Advanced Shortcode 2.3.2 by uploading a malicious PHP file via AJAX. It extracts the `_fmakey` from the target site and uses it to bypass authentication, then executes arbitrary commands via the uploaded webshell.
Description
The File Manager Advanced Shortcode WordPress plugin through 2.3.2 does not adequately prevent uploading files with disallowed MIME types when using the shortcode. This leads to RCE in cases where the allowed MIME type list does not include PHP files. In the worst case, this is available to unauthenticated users.
Exploits (2)
This exploit leverages an unauthenticated RCE vulnerability in File Manager Advanced Shortcode 2.3.2 by uploading a malicious PHP file via AJAX. It extracts the `_fmakey` from the target site and uses it to bypass authentication, then executes arbitrary commands via the uploaded webshell.
This Metasploit module exploits an unauthenticated RCE vulnerability in WordPress File Manager Advanced Shortcode plugin by uploading a malicious PHP payload disguised as a PNG file via a shortcode, bypassing MIME type restrictions.
References (2)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H