Description

Insufficient sanitizing in backup resulted in an arbitrary file read risk. The capability to access this feature is only available to teachers, managers and admins by default.

Remediation

References

CVE-2023-28330

Related Vulnerabilities

WordPress Plugin Booking.com Banner Creator Cross-Site Scripting (1.4.2)

WordPress Plugin Post SMTP-WP SMTP with Email Logs & Mobile App for Failure Alerts-Any SMTP Plus Gmail SMTP, Office 365, Brevo, Mailgun, Amazon SES, Postmark SQL Injection (2.9.3)

WordPress Plugin WordPress Landing Pages SQL Injection (1.2.1)

WordPress Plugin Post Snippets Security Bypass (3.0.5)

WordPress Plugin Music Store Cross-Site Scripting (1.0.41)

Severity

Medium

Classification

CVE-2023-28330 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Tags

Missing Update Known Vulnerabilities