CVE-2023-4819

The Shared Files WordPress plugin before 1.7.6 does not return the right Content-Type header for the specified uploaded file. Therefore, an attacker can upload an allowed file extension injected with malicious scripts.

Score

CVSS 3.1 6.1 Medium

Status

Modified - contact@wpscan.com

Published

2023-10-16

Last modified

2025-04-23

Affected products

• Shared Files (Tammersoft)
• Shared Files (Unknown)

References

• https://wpscan.com/vulnerability/4423b023-cf4a-46cb-b314-7a09ac08b29a