CVE-2023-4536 - My Account Page Editor < 1.3.2 - Subscriber+ Arbitrary File Upload

Back Back to CVE browser

HIGH

My Account Page Editor < 1.3.2 - Subscriber+ Arbitrary File Upload

Published Jan 16, 2024

8.8

HIGH

CVSS 3.1

EPSS 1.03%

Description

The My Account Page Editor WordPress plugin before 1.3.2 does not validate the profile picture to be uploaded, allowing any authenticated users, such as subscriber to upload arbitrary files to the server, leading to RCE

Affected products

Vendor n/a Product My Account Page Editor Default
unaffected
Affected
- ≥ 0, < 1.3.2

Default status is the baseline for the product. Each version can override it (patched versions can be marked unaffected).

Vendor	Product	Default status	Versions
n/a	My Account Page Editor	unaffected	Affected ≥ 0, < 1.3.2

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-434

Unrestricted Upload of File

References (2)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-54391
Advisory
https://wpscan.com/vulnerability/80e0e21c-9e6e-406d-b598-18eb222b3e3e/
exploitvdb-entrytechnical-descriptionThird Party Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-54391		Advisory
https://wpscan.com/vulnerability/80e0e21c-9e6e-406d-b598-18eb222b3e3e/		exploitvdb-entrytechnical-descriptionThird Party Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner WPScan

Published Jan 16, 2024

Updated Jun 20, 2025

Reserved Aug 25, 2023

Link CVE-2023-4536

CISA Vulnrichment

Updated Jan 16, 2024

NVD

Status Modified

Modified Jun 17, 2026

Link CVE-2023-4536

Red Hat

No data

ENISA EUVD

Assigner WPScan

Published Jan 16, 2024

Updated Jun 20, 2025

Link EUVD-2023-54391

GitHub

No data