CVE-2023-4243

HighCVSS 8.8

Published: 09/08/2023(UTC)Updated: 17/06/2026(UTC)Translated: 18/06/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

0.77%

51th percentile - higher than 51% of all known CVEs

Summary

The FULL - Customer plugin for WordPress is vulnerable to Arbitrary File Upload via the /install-plugin REST route in versions up to and including 2.2.3 due to improper authorization. This allows authenticated attackers with subscriber-level permissions and above to execute code by installing plugins from arbitrary remote locations.

Risk Assessment

Attackers can install malicious plugins, potentially leading to full control over the website and data leakage. This poses a serious security threat to the organization.

Recommendation

It is recommended to update the FULL - Customer plugin to the latest version to mitigate this vulnerability. Additionally, conducting a user permissions audit to restrict access to plugin installations is advisable.

Other vulnerabilities in FULL - Customer plugin for WordPress

CVE-2023-4242Medium
The FULL - Customer plugin for WordPress is vulnerable to Information Disclosure via the /health REST route in versions up to and including 2.2.3 due to improper authorization. This allows authenticated attackers with subscriber-level permissions and above to obtain sensitive information about the site configuration.

Original NVD description (English source)

The FULL - Customer plugin for WordPress is vulnerable to Arbitrary File Upload via the /install-plugin REST route in versions up to, and including, 2.2.3 due to improper authorization. This allows authenticated attackers with subscriber-level permissions and above to execute code by installing plugins from arbitrary remote locations including non-repository sources onto the site, granted they are packaged as a valid WordPress plugin.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS