CVE-2023-6140 Essential Real Estate < 4.4 - Subscriber+ Arbitrary File Upload
Subscribers can upload malicious PHP files disguised as ZIP archives, leading to remote code execution on sites using the Essential Real Estate plugin.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-6140?
CVE-2023-6140 is a high-severity vulnerability in Unknown Essential Real Estate, published on 8 Jan 2024. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
The Essential Real Estate WordPress plugin before 4.4.0 does not prevent users with limited privileges on the site, like subscribers, from momentarily uploading malicious PHP files disguised as ZIP archives, which may lead to remote code execution.
Weakness: CWE-434
Which versions are affected by CVE-2023-6140?
It affects 1 product.
Products include G5plus Essential Real Estate.
How do I fix CVE-2023-6140?
No fix has been published for CVE-2023-6140 yet. Limit exposure of the affected software until one is available.
Is CVE-2023-6140 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-6140 exists.
Other vulnerabilities in Unknown Essential Real Estate
- CVE-2025-48126 WordPress Essential Real Estate plugin <= 5.2.9 - Local File Inclusion vulnerability
- CVE-2025-30849 WordPress Essential Real Estate plugin <= 5.2.0 - Local File Inclusion Vulnerability
- CVE-2023-6827 Essential Real Estate <= 4.3.5 - Authenticated (Subscriber+) Arbitrary File Upload
- CVE-2023-6139 Essential Real Estate < 4.4.0 - Subscriber+ Denial of Service via Arbitrary Option Update
- CVE-2024-4273 Essential Real Estate <= 4.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Sources
Also known as GHSA-pmx3-5c86-vxfm.