CVE-2023-5673

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

The WP Mail Log WordPress plugin before 1.1.3 does not properly validate file extensions uploading files to attach to emails, allowing attackers to upload PHP files, leading to remote code execution.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-434

Affected software

Vendor	Product	Versions
Unknown	WP Mail Log	< 1.1.3

References

https://wpscan.com/vulnerability/231f72bf-9ad0-417e-b7a0-3555875749e9Exploit, Third Party Advisory
https://wpscan.com/vulnerability/231f72bf-9ad0-417e-b7a0-3555875749e9Exploit, Third Party Advisory

Timeline

Published: Dec 26, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-56748.8The WP Mail Log WordPress plugin before 1.1.3 does not properly sanitise and escape a parameter before using it in a SQL statement, leading CVE-2023-56756.5A flaw was found in Quarkus. When a Quarkus RestEasy Classic or Reactive JAX-RS endpoint has its methods declared in the abstract Java class CVE-2023-56765.9In Eclipse OpenJ9 before version 0.41.0, the JVM can be forced into an infinite busy hang on a spinlock or a segmentation fault if a shutdow CVE-2023-56778.8Brandon Rothel from QED Secure Solutions and Sam Hanson of Dragos have found that the VAPIX API tcptest.cgi did not have a sufficient input CVE-2023-56785.3Issue summary: Generating excessively long X9.42 DH keys or checking excessively long X9.42 DH keys or parameters may be very slow. Impact CVE-2023-56797.5A bad interaction between DNS64 and serve-stale may cause `named` to crash with an assertion failure during recursive resolution, when both CVE-2023-56805.3If a resolver cache has a very large number of ECS records stored for the same name, the process of cleaning the cache database node for thi CVE-2023-56817.2A vulnerability, which was classified as critical, was found in Netentsec NS-ASG Application Security Gateway 6.3. This affects an unknown p CVE-2023-56829.8A vulnerability has been found in Tongda OA 2017 and classified as critical. This vulnerability affects unknown code of the file general/hr/CVE-2023-56839.8A vulnerability was found in Byzoro Smart S85F Management Platform up to 20231010 and classified as critical. This issue affects some unknow CVE-2023-56849.8A vulnerability was found in Byzoro Smart S85F Management Platform up to 20231012. It has been declared as critical. Affected by this vulner CVE-2023-56857.5A flaw was found in XNIO. The XNIO NotifierState that can cause a Stack Overflow Exception when the chain of notifier states becomes problem