CVE-2023-4836

The WordPress File Sharing Plugin WordPress plugin before 2.0.5 does not check authorization before displaying files and folders, allowing users to gain access to those filed by manipulating IDs which can easily be brute forced

CVSS v3.1

4.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

CVSS v3.1

4.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

EPSS

0.49% chance of exploitation in the next 30 days, 40th percentile

Published

2023-10-31

Updated

2025-04-03

Proof-of-concept exploits (2)

• https://research.cleantalk.org/cve-2023-4836-user-private-files-idor-to-sensitive-data-an…
• https://wpscan.com/vulnerability/c17f2534-d791-4fe3-b45b-875777585dc6

References

• CVE Record
• NVD entry

Related

• CVE-2023-48312
• CVE-2023-48409
• CVE-2023-48309
• CVE-2023-4844
• CVE-2023-48295
• CVE-2023-4845