File Manager Advanced Shortcode CVEs and Security Vulnerabilities

CVE-2023-7061

Advanced File Manager Shortcode <= 2.5.3 - Authenticated (Contributor+) Arbitrary File Upload

The Advanced File Manager Shortcodes plugin for WordPress is vulnerable to arbitrary file uploads in all versions up to, and including, 2.5.3. This makes it possible for authenticated attackers with contributor access or above to upload arbitrary files on the affected site's server which may make remote code execution possible.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Advancedfilemanager

Products

File Manager Advanced Shortcode

CVE-2023-2068

File Manager Advanced Shortcode <= 2.3.2 - Unauthenticated Remote Code Execution through shortcode

The File Manager Advanced Shortcode WordPress plugin through 2.3.2 does not adequately prevent uploading files with disallowed MIME types when using the shortcode. This leads to RCE in cases where the allowed MIME type list does not include PHP files. In the worst case, this is available to unauthenticated users.

CVSS 3.1 · 9.8 Critical EPSS 39.6% KEV · Not listed