WordPress Plugin Vulnerabilities

Icons Font Loader < 1.1.3 - Admin+ Arbitrary File Upload

Description

The plugin does not properly validate files to be uploaded, allowing high privilege users such as admin to upload arbitrary file on the server

Affects Plugins

Plugin icon
icons-font-loader
Fixed in 1.1.3

References

CVE
CVE-2023-5860

Miscellaneous

Original Researcher
Alex Thomas
Verified
No
WPVDB ID
c1ed4006-0322-4cab-a89a-bfabb675361b

Timeline

Publicly Published
2023-11-01 (about 2 years ago)
Added
2023-11-17 (about 2 years ago)
Last Updated
2023-11-17 (about 2 years ago)

Other

Published
Title
Published
2024-07-03
Title
IMGspider < 2.3.11 - Authenticated (Contributor+) Arbitrary File Upload via 'upload'
Published
2014-08-01
Title
Front File Manager 0.1 - Arbitrary File Upload
Published
2024-10-21
Title
Custom Icons for Elementor < 0.3.4 - Authenticated (Admin+) Arbitrary File Upload
Published
2021-08-16
Title
Simple eCommerce <= 3.1.2 - Arbitrary File Upload
Published
2024-12-18
Title
WP SuperBackup < 2.4 - Unauthenticated Arbitrary File Upload