CVE-2023-6826

HighCVSS 7.2/10Last modified Jun 17, 2026

Description

The E2Pdf plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation on the 'import_action' function in versions up to, and including, 1.20.25. This makes it possible for authenticated attackers with a role that the administrator previously granted access to the plugin, to upload arbitrary files on the affected site's server which may make remote code execution possible.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-434

Affected software

No affected versions have been published.

Timeline

Published
Dec 15, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-68278.8The Essential Real Estate plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation on the 'ajaxCVE-2023-68286.1The Contact Form, Survey & Popup Form Plugin for WordPress – ARForms Form Builder plugin for WordPress is vulnerable to Stored Cross-Site SCVE-2023-68306.1The Formidable Forms plugin for WordPress is vulnerable to HTML injection in versions up to, and including, 6.7. This vulnerability allows uCVE-2023-68318.1Path Traversal: '\..\filename' in GitHub repository mlflow/mlflow prior to 2.9.2.CVE-2023-68324.3Business Logic Errors in GitHub repository microweber/microweber prior to 2.0.CVE-2023-68334.4Insertion of Sensitive Information into Log File vulnerability in Hitachi Ops Center Administrator allows local users to gain sensitive infoCVE-2023-68355.3Multiple WSO2 products have been identified as vulnerable due to lack of server-side input validation in the Forum feature, API rating couldCVE-2023-68367.5Multiple WSO2 products have been identified as vulnerable due to an XML External Entity (XXE) attack abuses a widely available but rarely usCVE-2023-68378.2Multiple WSO2 products have been identified as vulnerable to perform user impersonatoin using JIT provisioning. In order for this vulnerabilCVE-2023-68386.1Reflected XSS vulnerability can be exploited by tampering a request parameter in Authentication Endpoint. This can be performed in both authCVE-2023-68395.3Due to improper error handling, a REST API resource could expose a server side error containing an internal WSO2 specific package name in thCVE-2023-68406.7An issue has been discovered in GitLab EE affecting all versions from 16.4 prior to 16.6.7, 16.7 prior to 16.7.5, and 16.8 prior to 16.8.2 w