CVE-2023-47873
WP Child Theme Generator <= 1.1.2 - Authenticated (Administrator+) Arbitrary File Upload
criticalUnrestricted Upload of File with Dangerous Type
9.1
CVSS Score
9.1
CVSS Score
critical
Severity
1.1.3
Patched in
299d
Time to patch
Description
The WP Child Theme Generator plugin for WordPress is vulnerable to arbitrary file uploads in all versions up to, and including, 1.1.2 due to insufficient file type checking in the wctg_custom_child_theme_process() function. This makes it possible for administrators to upload arbitrary files on the affected site's server which may make remote code execution possible.
CVSS Vector Breakdown
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:HAttack Vector
Network
Attack Complexity
Low
Privileges Required
High
User Interaction
None
Scope
Changed
High
Confidentiality
High
Integrity
High
Availability
Technical Details
Affected versions
<=1.1.2PublishedNovember 20, 2023
Last updatedSeptember 13, 2024
Affected pluginwp-child-theme-generator
Check if your site is affected.
Run a free security audit to detect vulnerable plugins, outdated versions, and misconfigurations.