What is CVE-2023-4488?

CVE-2023-4488 is a critical-severity vulnerability in Hyno Dropbox Folder Share, classified under PHP Remote File Inclusion. CVSS score: 9.8/10. Published 2023-10-20.

How severe is CVE-2023-4488?

Critical severity. CVSS v3 base score is 9.8 out of 10.

Is CVE-2023-4488 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Vulnerability in Hyno Dropbox Folder Share

CVE-2023-4488

The Dropbox Folder Share for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 1.9.7 via the editor-view.php file. This allows unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.

EPSS: 0.010 (59.1th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

Affected products

Hyno Dropbox Folder Share — versions 0
Hynotech Dropbox_folder_share

Weakness classification (CWE)

Public proof-of-concept exploits

20142995/nuclei-templates

References

security@wordfence.com (Patch, Third Party Advisory)
security@wordfence.com (Patch)

Frequently asked questions

What is CVE-2023-4488?: CVE-2023-4488 is a critical-severity vulnerability in Hyno Dropbox Folder Share, classified under PHP Remote File Inclusion. CVSS score: 9.8/10. Published 2023-10-20.
How severe is CVE-2023-4488?: Critical severity. CVSS v3 base score is 9.8 out of 10.
Is CVE-2023-4488 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.