CVE-2023-0924 Zyrex Popup <= 1.0 - Admin+ Arbitrary File Upload
Administrators can upload arbitrary files via the ZYREX POPUP plugin, potentially leading to code execution even in restricted multisite environments.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-0924?
CVE-2023-0924 is a high-severity vulnerability in Unknown ZYREX POPUP, published on 2 May 2023. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
The ZYREX POPUP WordPress plugin through 1.0 does not validate the type of files uploaded when creating a popup, allowing a high privileged user (such as an Administrator) to upload arbitrary files, even when modifying the file system is disallowed, such as in a multisite install.
Weakness: CWE-434
Which versions are affected by CVE-2023-0924?
It affects 1 product.
Products include Zyrex Popup.
How do I fix CVE-2023-0924?
No fix has been published for CVE-2023-0924 yet. Limit exposure of the affected software until one is available.
Is CVE-2023-0924 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-0924 exists.
Sources
Also known as GHSA-9q4q-2728-w948.