CVE-2023-4238

HighCVSS 7.2/10Last modified Jun 17, 2026

Description

The Prevent files / folders access WordPress plugin before 2.5.2 does not validate files to be uploaded, which could allow attackers to upload arbitrary files such as PHP on the server.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Affected software

Vendor	Product	Versions
Unknown	Prevent files / folders access	< 2.5.2

References

https://wpscan.com/vulnerability/53816136-4b1a-4b7d-b73b-08a90c2a638fExploit, Third Party Advisory
https://wpscan.com/vulnerability/53816136-4b1a-4b7d-b73b-08a90c2a638fExploit, Third Party Advisory

Timeline

Published: Sep 25, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-423877.5An issue in TDSQL Chitu management platform v.10.3.19.5.0 allows a remote attacker to obtain sensitive information via get_db_info function CVE-2023-42396.5The Real Estate Manager plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 7.2 due to insufficient CVE-2023-423989.8An issue in zzCMS v.2023 allows a remote attacker to execute arbitrary code and obtain sensitive information via the ueditor component in co CVE-2023-423996.1Cross Site Scripting vulnerability in xdsoft.net Jodit Editor v.4.0.0-beta.86 allows a remote attacker to obtain sensitive information via t CVE-2023-424049.8OneVision Workspace before WS23.1 SR1 (build w31.040) allows arbitrary Java EL execution.CVE-2023-424059.8SQL injection vulnerability in FIT2CLOUD RackShift v1.7.1 allows attackers to execute arbitrary code via the `sort` parameter to taskService CVE-2023-424069.8SQL injection vulnerability in D-Link Online behavior audit gateway DAR-7000 V31R02B1413C allows a remote attacker to obtain sensitive infor CVE-2023-42417.5lol-html can cause panics on certain HTML inputs. Anyone processing arbitrary 3rd party HTML with the library is affected.CVE-2023-424193.8Maintenance Server, in Cybellum's QCOW air-gapped distribution (China Edition), versions 2.15.5 through 2.27, was compiled with a hard-coded CVE-2023-42424.3The FULL - Customer plugin for WordPress is vulnerable to Information Disclosure via the /health REST route in versions up to, and including CVE-2023-424259.8An issue in Turing Video Turing Edge+ EVC5FD v.1.38.6 allows remote attacker to execute arbitrary code and obtain sensitive information via CVE-2023-424266.1Cross-site scripting (XSS) vulnerability in Froala Froala Editor v.4.1.1 allows remote attackers to execute arbitrary code via the 'Insert l