CVE-2023-4836

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

The WordPress File Sharing Plugin WordPress plugin before 2.0.5 does not check authorization before displaying files and folders, allowing users to gain access to those filed by manipulating IDs which can easily be brute forced

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-639

Affected software

Vendor	Product	Versions
Unknown	WordPress File Sharing Plugin	< 2.0.5

References

https://research.cleantalk.org/cve-2023-4836-user-private-files-idor-to-sensitive-data-and-private-files-exposure-leak-of-info-pocExploit, Third Party Advisory
https://wpscan.com/vulnerability/c17f2534-d791-4fe3-b45b-875777585dc6Exploit, Third Party Advisory
https://research.cleantalk.org/cve-2023-4836-user-private-files-idor-to-sensitive-data-and-private-files-exposure-leak-of-info-pocExploit, Third Party Advisory
https://wpscan.com/vulnerability/c17f2534-d791-4fe3-b45b-875777585dc6Exploit, Third Party Advisory
https://wpscan.com/vulnerability/c17f2534-d791-4fe3-b45b-875777585dc6Exploit, Third Party Advisory

Timeline

Published: Oct 31, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-483605.5in OpenHarmony v3.2.2 and prior versions allow a local attacker cause multimedia player crash through modify a released pointer.CVE-2023-483612.3Improper initialization in firmware for some Intel(R) CSME may allow a privileged user to potentially enable information disclosure via loca CVE-2023-483628.8XXE in the XML Format Plugin in Apache Drill version 1.19.0 and greater allows a user to read any file on a remote file system or execute co CVE-2023-483636.5A vulnerability has been identified in OpenPCS 7 V9.1 (All versions < V9.1 SP2 UC05), SIMATIC BATCH V9.1 (All versions < V9.1 SP2 UC05), SIM CVE-2023-483646.5A vulnerability has been identified in OpenPCS 7 V9.1 (All versions < V9.1 SP2 UC05), SIMATIC BATCH V9.1 (All versions < V9.1 SP2 UC05), SIM CVE-2023-483659.9Qlik Sense Enterprise for Windows before August 2023 Patch 2 allows unauthenticated remote code execution, aka QB-21683. Due to improper val CVE-2023-483665.3Race condition in some Intel(R) System Security Report and System Resources Defense firmware may allow a privileged user to potentially enab CVE-2023-483685.5Improper input validation in Intel(R) Media SDK software all versions may allow an authenticated user to potentially enable denial of servic CVE-2023-483695.3Mattermost fails to limit the log size of server logs allowing an attacker sending specially crafted requests to different endpoints to pote CVE-2023-48378.8SmodBIP is vulnerable to Cross-Site Request Forgery, that could be used to induce logged in users to perform unintended actions, including c CVE-2023-483719.8ITPison OMICARD EDM’s file uploading function does not restrict upload of file with dangerous type. An unauthenticated remote attacker can e CVE-2023-483729.8ITPison OMICARD EDM 's SMS-related function has insufficient validation for user input. An unauthenticated remote attacker can exploit this