Vulnerability in Notetoservices Upload Media By Url
CVE-2023-3720
The Upload Media By URL WordPress plugin before 1.0.8 does not have CSRF check when uploading files, which could allow attackers to make logged in admins upload files (including HTML containing JS code for users with the unfiltered_html capability) on their behalf.
EPSS: 0.003 (23.4th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N.
Affected products
- Notetoservices Upload_media_by_url
- Unknown Upload Media By Url — versions 0
Public proof-of-concept exploits
References
- contact@wpscan.com (Exploit, technical-description, Third Party Advisory, exploit, vdb-entry)
Frequently asked questions
- What is CVE-2023-3720?
- CVE-2023-3720 is a medium-severity vulnerability in Notetoservices Upload Media By Url, classified under CWE-352 CROSS-SITE REQUEST FORGERY (CSRF). CVSS score: 6.5/10. Published 2023-08-30.
- How severe is CVE-2023-3720?
- Medium severity. CVSS v3 base score is 6.5 out of 10.
- Is CVE-2023-3720 known to be exploited?
- 2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.