CVE-2023-0924
High
Description
The ZYREX POPUP WordPress plugin through 1.0 does not validate the type of files uploaded when creating a popup, allowing a high privileged user (such as an Administrator) to upload arbitrary files, even when modifying the file system is disallowed, such as in a multisite install.
SeverityHigh
CVSS7.2
Exploit probability—
ProductZyrex Popup
PublishedMay 2, 2023
First seenMay 2, 2023
Weakness typeCWE-434Unrestricted upload of dangerous file type
How to fix
Update
- zyrex popup1.1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| zyrex popup | v < 1.1 | 1.1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.