VulnerabilityModified

CVE-2023-0467

This leads to Local File Inclusion on servers where non-existent directories may be traversed, or when chained with another vulnerability allowing arbitrary directory creation.

MEDIUM 4.3EPSS 0.68%

Does this matter?

Lower severity and a low EPSS score (0.68%). Track it; it rarely justifies an emergency change on its own.

Description

The WP Dark Mode WordPress plugin before 4.0.8 does not properly sanitize the style parameter in shortcodes before using it to load a PHP template. This leads to Local File Inclusion on servers where non-existent directories may be traversed, or when chained with another vulnerability allowing arbitrary directory creation.

CVSS 3.1: 4.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
EPSS: 0.68% probability · 50th percentile
CISA KEV: Not listed
Weakness: CWE-22
Affected: wppool/wp dark mode
Source: contact@wpscan.com

References

https://wpscan.com/vulnerability/8eb431a6-59a5-4cee-84e0-156c0b31cfc4Exploit, Third Party Advisory
https://wpscan.com/vulnerability/8eb431a6-59a5-4cee-84e0-156c0b31cfc4Exploit, Third Party Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.