WordPress Plugin Vulnerabilities

WP MLM <= 4.0 - Unauthenticated Arbitrary File Upload

Description

The WP MLM SOFTWARE PLUGIN plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in all versions up to, and including, 4.0. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.

Affects Plugins

Plugin icon
wp-mlm
No known fix

References

CVE
CVE-2023-51475
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/b3451ed9-9a9a-443f-b1ce-dcd07bd3e6ce

Miscellaneous

Original Researcher
Rafie Muhammad
Verified
No
WPVDB ID
34e22437-50a6-481c-996e-30493320781e

Timeline

Publicly Published
2023-12-27 (about 2 years ago)
Added
2024-01-05 (about 2 years ago)
Last Updated
2024-01-22 (about 2 years ago)

Other

Published
Title
Published
2013-11-02
Title
Chameleon - Arbitrary File Upload
Published
2023-07-14
Title
User Registration < 3.0.2.1 - Subscriber+ Arbitrary File Upload Leading to RCE
Published
2014-08-01
Title
SFBrowser 1.4.5 - connectors/php/sfbrowser.php File Upload PHP Code Execution
Published
2014-08-01
Title
vithy - Arbitrary File Upload
Published
2025-07-14
Title
HT Contact Form Widget For Elementor Page Builder & Gutenberg Blocks & Form Builder. < 2.2.2 - Unauthenticated Arbitrary File Upload