WordPress Plugin Vulnerabilities

WP Child Theme Generator < 1.1.3 - Admin+ Arbitrary File Upload

Description

The plugin is vulnerable to arbitrary file uploads, allowing administrators to upload arbitrary files on the affected site's server which may make remote code execution possible.

Affects Plugins

Plugin icon
wp-child-theme-generator
Fixed in 1.1.3

References

CVE
CVE-2023-47873
URL
https://patchstack.com/database/vulnerability/wp-child-theme-generator/wordpress-wp-child-theme-generator-plugin-1-0-8-arbitrary-file-upload-vulnerability

Miscellaneous

Original Researcher
Dateoljo of BoB 12th
Verified
No
WPVDB ID
d2dce65c-be93-4595-a4bc-6cd3aea7256a

Timeline

Publicly Published
2023-11-20 (about 2 years ago)
Added
2023-11-28 (about 2 years ago)
Last Updated
2024-09-13 (about 1 year ago)

Other

Published
Title
Published
2014-08-01
Title
Rent A Car 1.0 - Shell Upload
Published
2026-02-18
Title
Slider Future <= 1.0.5 - Unauthenticated Arbitrary File Upload
Published
2024-10-14
Title
Digital Lottery <= 3.0.5 - Unauthenticated Arbitrary File Upload
Published
2018-12-24
Title
Baggage Freight Shipping Australia 0.1.0 - Unauthenticated Arbitrary File Upload
Published
2025-02-04
Title
Contact Manager < 8.6.5 - Unauthenticated Arbitrary Double File Extension Upload