CVE-2023-3720
Medium
Description
The Upload Media By URL WordPress plugin before 1.0.8 does not have CSRF check when uploading files, which could allow attackers to make logged in admins upload files (including HTML containing JS code for users with the unfiltered_html capability) on their behalf.
SeverityMedium
CVSS6.5
Exploit probability—
ProductNotetoservices Upload Media By Url
PublishedAug 30, 2023
First seenAug 30, 2023
How to fix
Update
- notetoservices upload_media_by_url1.0.8 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| notetoservices upload_media_by_url | v < 1.0.8 | 1.0.8 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.