CVE-2023-2688

MEDIUM 4.9CVE-2023-2688 · Published 09/06/2023 · updated 17/06/2026

Package	Affected versions	Patched versions
wordpress file upload iptanus	`≤ 4.19.1`	No fix yet
wordpress file upload pro iptanus	`≤ 4.19.1`	No fix yet

Description

The WordPress File Upload and WordPress File Upload Pro plugins for WordPress are vulnerable to Path Traversal in versions up to, and including, 4.19.1 via the vulnerable parameter wfu_newpath. This allows administrator-level attackers to move files uploaded with the plugin (located in wp-content/uploads by default) outside of the web root.

References

plugins.trac.wordpress.org/changeset · Patch
wordfence.com/threat-intel/vulnerabilities/id/abd6eeac-0a7e-4762-809f-593cd85f303d · Third Party Advisory

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free