CVE-2023-0477 describes a critical arbitrary file upload vulnerability in the Auto Featured Image (Auto Post Thumbnail) WordPress plugin prior to version 3.9.16. This flaw, stemming from improper file extension validation, allows authenticated users with at least Author privileges to upload malicious PHP files. With a CVSS score of 8.8 (HIGH), successful exploitation could lead to high impact on confidentiality, integrity, and availability of the affected system. Currently, there is no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion surrounding this vulnerability.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 3.9.16CPE matchmatch criteria | cpe:2.3:a:cm-wp:auto_featured_image:*:*:*:*:*:wordpress:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.3 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.