CVE-2023-4636

MEDIUM

WordPress File Sharing Plugin <2.0.3 - XSS

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 2 public exploits for CVE-2023-4636. PoCs published by Ap0dexMe0, ThatNotEasy.

AI-analyzed exploit summary This repository contains a functional exploit for CVE-2023-4636, targeting WordPress with default Imagick to achieve unauthenticated remote code execution. The exploit generates polyglot PNG/PHP and SVG/MSL files to bypass security measures and execute arbitrary code.

Description

The WordPress File Sharing Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in versions up to, and including, 2.0.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.

Exploits (2)

nomisec WORKING POC
by Ap0dexMe0 · poc
https://github.com/Ap0dexMe0/CVE-2023-4636

This repository contains a functional exploit for CVE-2023-4636, targeting WordPress with default Imagick to achieve unauthenticated remote code execution. The exploit generates polyglot PNG/PHP and SVG/MSL files to bypass security measures and execute arbitrary code.

Classification
Working Poc 90%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: WordPress with default Imagick
No auth needed
Prerequisites: WordPress installation with Imagick enabled · Access to a remote FTP server for storing SVG files · Access to a remote HTTP server for storing the final polyglot PNG/PHP file
devstral-2 · analyzed May 16, 2026 Full analysis →
nomisec WORKING POC
by ThatNotEasy · poc
https://github.com/ThatNotEasy/CVE-2023-4636

This repository contains a functional exploit for CVE-2023-4634, targeting WordPress with default Imagick configurations. The exploit generates polyglot PNG/PHP and SVG/MSL files to achieve unauthenticated remote code execution by leveraging ImageMagick's file handling vulnerabilities.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: WordPress with default Imagick
No auth needed
Prerequisites: WordPress installation with vulnerable Imagick configuration · Access to a remote FTP/HTTP server for staging files
devstral-2 · analyzed Feb 18, 2026 Full analysis →

Scores

CVSS v3 4.4
EPSS 0.0088
EPSS Percentile 54.3%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-79
Status published
Products (2)
deepakkite/File Sharing & Download Manager – User Private Files < 2.0.3
userprivatefiles/wordpress_file_sharing_plugin < 2.0.3
Published Sep 05, 2023
Tracked Since Feb 18, 2026