CVEvulnerability
CVE-2023-4836
4.3 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2023-10-31
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 4.3 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
- CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
- 4.3 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
- Weaknesses
- CWE-639
Description
The WordPress File Sharing Plugin WordPress plugin before 2.0.5 does not check authorization before displaying files and folders, allowing users to gain access to those filed by manipulating IDs which can easily be brute forced
Affected configurations
• userprivatefiles wordpress file sharing plugin (< 2.0.5)
Related
Weakness · CWE (1)
- CWE-639 Authorization Bypass Through User-Controlled Key weakness
References
- https://research.cleantalk.org/cve-2023-4836-user-private-files-idor-to-sensitive-data-and-private-files-exposure-leak-of-info-poc Exploit, Third Party Advisory
- https://wpscan.com/vulnerability/c17f2534-d791-4fe3-b45b-875777585dc6 Exploit, Third Party Advisory
- https://research.cleantalk.org/cve-2023-4836-user-private-files-idor-to-sensitive-data-and-private-files-exposure-leak-of-info-poc Exploit, Third Party Advisory
- https://wpscan.com/vulnerability/c17f2534-d791-4fe3-b45b-875777585dc6 Exploit, Third Party Advisory
- https://wpscan.com/vulnerability/c17f2534-d791-4fe3-b45b-875777585dc6 Exploit, Third Party Advisory