{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2023-4536","assignerOrgId":"1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81","state":"PUBLISHED","assignerShortName":"WPScan","dateReserved":"2023-08-25T08:23:02.486Z","datePublished":"2024-01-16T15:56:33.488Z","dateUpdated":"2025-06-20T17:04:16.414Z"},"containers":{"cna":{"providerMetadata":{"orgId":"1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81","shortName":"WPScan","dateUpdated":"2024-01-16T15:56:33.488Z"},"title":"My Account Page Editor < 1.3.2 - Subscriber+ Arbitrary File Upload","problemTypes":[{"descriptions":[{"description":"CWE-434 Unrestricted Upload of File with Dangerous Type","lang":"en","type":"CWE"}]}],"affected":[{"vendor":"Unknown","product":"My Account Page Editor","versions":[{"status":"affected","versionType":"semver","version":"0","lessThan":"1.3.2"}],"defaultStatus":"unaffected"}],"descriptions":[{"lang":"en","value":"The My Account Page Editor WordPress plugin before 1.3.2 does not validate the profile picture to be uploaded, allowing any authenticated users, such as subscriber to upload arbitrary files to the server, leading to RCE"}],"references":[{"url":"https://wpscan.com/vulnerability/80e0e21c-9e6e-406d-b598-18eb222b3e3e/","tags":["exploit","vdb-entry","technical-description"]}],"credits":[{"lang":"en","value":"Alexander Concha","type":"finder"},{"lang":"en","value":"WPScan","type":"coordinator"}],"source":{"discovery":"EXTERNAL"},"x_generator":{"engine":"WPScan CVE Generator"}},"adp":[{"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2024-08-02T07:31:06.284Z"},"title":"CVE Program Container","references":[{"url":"https://wpscan.com/vulnerability/80e0e21c-9e6e-406d-b598-18eb222b3e3e/","tags":["exploit","vdb-entry","technical-description","x_transferred"]}]},{"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":8.8,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"LOW","confidentialityImpact":"HIGH"}},{"other":{"type":"ssvc","content":{"timestamp":"2024-01-16T20:51:28.512471Z","id":"CVE-2023-4536","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"title":"CISA ADP Vulnrichment","providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2025-06-20T17:04:16.414Z"}}]}}