Security Advisory

CVE-2023-0477

CVE vulnerability detail — eXtreme Datacenter Security Operations

Published 2023-03-13 16:03:28

Last updated 2025-02-27 20:19:02

Assigner WPScan

State PUBLISHED

Description

The Auto Featured Image (Auto Post Thumbnail) WordPress plugin before 3.9.16 includes an AJAX endpoint that allows any user with at least Author privileges to upload arbitrary files, such as PHP files. This is caused by incorrect file extension validation.

← Browse all CVEs View on cve.org ↗