CVE-2023-4536 — My Account Page Editor < 1.3.2 - Subscriber+ Arbitrary File Upload
The My Account Page Editor WordPress plugin before 1.3.2 does not validate the profile picture to be uploaded, allowing any authenticated users, such as subscriber to upload arb…
Published: 2024-01-16 · CVSS: 8.8 · CVSS 3.1
The My Account Page Editor WordPress plugin before 1.3.2 does not validate the profile picture to be uploaded, allowing any authenticated users, such as subscriber to upload arbitrary files to the server, leading to RCE
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7