CVE-2023-5816
External Control of File Name or Path (CWE-73)
The Code Explorer plugin for WordPress is vulnerable to arbitrary external file reading in all versions up to, and including, 1.4.5. This is due to the fact that the plugin does not restrict accessing files to those outside of the WordPress instance, though the intention of the plugin is to only access WordPress related files. This makes it possible for authenticated attackers, with administrator-level access, to read files outside of the WordPress instance.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Timeline
Feedly found the first article mentioning CVE-2023-5816. See article
Feedly estimated the CVSS score as HIGH
NVD published the first details for CVE-2023-5816
A CVSS base score of 4.9 has been assigned.
CVE-2023-5816 is a medium-severity vulnerability (CVSS 3.1 Base Score: 4.90) in the Code Explorer plugin for WordPress, allowing authenticated attackers with administrator-level access to read arbitrary external files outside the WordPress instance. The vulnerability affects all versions up to and including 1.4.5, and while the article does not mention any proof-of-concept exploits or specific mitigations, it highlights the potential risk of unauthorized file access. There is no indication of exploitation in the wild or downstream impacts on other third-party vendors. See article
EPSS Score was set to: 0.04% (Percentile: 9.9%)