CVE-2023-6925

Summary

CVE-2023-6925 is a vulnerability affecting the Unlimited Addons for WPBakery Page Builder plugin for WordPress. This issue stems from insufficient file type validation within the 'importZipFile' function, which exists in versions up to and including 1.0.42. Consequently, authenticated attackers can exploit this vulnerability by uploading arbitrary files, potentially gaining the ability to execute remote code. The default role for accessing this plugin is editor, but contributor access can also be granted.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.