CVE-2023-5762 json
Filr – Secure document library < 1.2.3.6 - Author+ RCE via file upload with phar ext
published 2023-12-04 2 y ago modified 2026-06-17 4 mo ago also EUVD-2023-58047
- cvss
- 8.8
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 2.0%
- EPSS 2.0% chance of exploitation in 30 days, percentile 81%
- public exploits
- 0
- none known
Summary
The Filr WordPress plugin before 1.2.3.6 is vulnerable from an RCE (Remote Code Execution) vulnerability, which allows the operating system to execute commands and fully compromise the server on behalf of a user with Author-level privileges.
Patch / fix
- Unknown Filr 1.2.3.6
Exploit prediction
2.02% chance of exploitation in the next 30 days, higher than 81% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- wpscan.com https://wpscan.com/vulnerability/6ad99725-eccc-4b61-bce2-668b62619deb referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.1 | 8.8 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Affected products
- Unknown Filr
Classification
- Weakness
-
- CWE-94 Improper Control of Generation of Code
- Technology feeds
References
-
wpscan.com
/vulnerability/6ad99725-eccc-4b61-bce2-668b62619deb
exploit, vdb-entry, technical-description, third-party-advisory
Sources
- CVE List CVE-2023-5762
- NVD CVE-2023-5762
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.