CVE-2023-0477
Assigner: WPScan
Published: 2023-03-13T16:03:28.116Z
State: PUBLISHED
title: Auto Featured Image < 3.9.16 - Author+ Arbitrary File Upload
problemTypes: descriptions: description: CWE-434 Unrestricted Upload of File with Dangerous Type
type: CWE
affected: vendor: Unknown
product: Auto Featured Image (Auto Post Thumbnail)
versions: status: affected
versionType: custom
version: 0
lessThan: 3.9.16
defaultStatus: unaffected
collectionURL: https://wordpress.org/plugins
descriptions: value: The Auto Featured Image (Auto Post Thumbnail) WordPress plugin before 3.9.16 includes an AJAX endpoint that allows any user with at least Author privileges to upload arbitrary files, such as PHP files. This is caused by incorrect file extension validation.
credits: value: dc11
type: finder
value: WPScan
type: coordinator
source: discovery: EXTERNAL
x_generator: engine: WPScan CVE Generator