CVE-2023-7062 - Vulnerability Details - OpenCVE

The Advanced File Manager Shortcodes plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.4. This makes it possible for attackers with contributor access or higher to read the contents of arbitrary files on the server, which can contain sensitive information.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.03293.

Exploitation none

Automatable no

Technical Impact partial

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Advanced File Manager

Advanced File Manager Shortcodes

unaffected

Version	Status	Constraints
`0`	affected	≤ 2.4

No data.

No data.

No data.

Project Subscriptions

No data.

Advisories

Source	ID	Title
EUVD	EUVD-2023-59249	The Advanced File Manager Shortcodes plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.4. This makes it possible for attackers with contributor access or higher to read the contents of arbitrary files on the server, which can contain sensitive information.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References

Link	Providers
https://advancedfilemanager.com/product/file-manager-advanced-shortcode-wordpress/
https://www.wordfence.com/threat-intel/vulnerabilities/id/8bf009f5-cf9e-4d38-9679-d3abb5817d30?source=cve

History

Wed, 08 Apr 2026 17:45:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-538

Projects

Sign in to view the affected projects.

MITRE

Status: PUBLISHED

Assigner: Wordfence

Published: 2024-07-10T02:02:46.771Z

Updated: 2026-04-08T17:05:55.482Z

Reserved: 2023-12-21T17:26:28.697Z

Link: CVE-2023-7062

Vulnrichment

Updated: 2024-08-02T08:50:07.902Z

NVD

Status : Awaiting Analysis

Published: 2024-07-10T02:15:02.960

Modified: 2026-04-08T18:18:47.640

Link: CVE-2023-7062

Redhat

No data.

OpenCVE Enrichment

No data.

Weaknesses

CWE-538

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2023-7062", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2023-12-21T17:26:28.697Z", "datePublished": "2024-07-10T02:02:46.771Z", "dateUpdated": "2026-04-08T17:05:55.482Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:05:55.482Z"}, "affected": [{"vendor": "Advanced File Manager", "product": "Advanced File Manager Shortcodes", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "2.4", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Advanced File Manager Shortcodes plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.4. This makes it possible for attackers with contributor access or higher to read the contents of arbitrary files on the server, which can contain sensitive information."}], "title": "Advanced File Manager Shortcodes <= 2.4 - Authenticated (Contributor+) Directory Traversal", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/8bf009f5-cf9e-4d38-9679-d3abb5817d30?source=cve"}, {"url": "https://advancedfilemanager.com/product/file-manager-advanced-shortcode-wordpress/"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-538 Insertion of Sensitive Information into Externally-Accessible File or Directory", "cweId": "CWE-538", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH"}}], "credits": [{"lang": "en", "type": "finder", "value": "Colin Xu"}], "timeline": [{"time": "2024-07-08T00:00:00.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-07-10T14:05:13.276654Z", "id": "CVE-2023-7062", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-07-10T14:05:24.745Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T08:50:07.902Z"}, "title": "CVE Program Container", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/8bf009f5-cf9e-4d38-9679-d3abb5817d30?source=cve", "tags": ["x_transferred"]}, {"url": "https://advancedfilemanager.com/product/file-manager-advanced-shortcode-wordpress/", "tags": ["x_transferred"]}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/8bf009f5-cf9e-4d38-9679-d3abb5817d30?source=cve", "tags": ["x_transferred"]}, {"url": "https://advancedfilemanager.com/product/file-manager-advanced-shortcode-wordpress/", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T08:50:07.902Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2023-7062", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-07-10T14:05:13.276654Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-07-10T14:05:20.309Z"}}], "cna": {"title": "Advanced File Manager Shortcodes <= 2.4 - Authenticated (Contributor+) Directory Traversal", "credits": [{"lang": "en", "type": "finder", "value": "Colin Xu"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 8.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}}], "affected": [{"vendor": "Advanced File Manager", "product": "Advanced File Manager Shortcodes", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "2.4"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2024-07-08T00:00:00.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/8bf009f5-cf9e-4d38-9679-d3abb5817d30?source=cve"}, {"url": "https://advancedfilemanager.com/product/file-manager-advanced-shortcode-wordpress/"}], "descriptions": [{"lang": "en", "value": "The Advanced File Manager Shortcodes plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.4. This makes it possible for attackers with contributor access or higher to read the contents of arbitrary files on the server, which can contain sensitive information."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-538", "description": "CWE-538 Insertion of Sensitive Information into Externally-Accessible File or Directory"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:05:55.482Z"}}}, "cveMetadata": {"cveId": "CVE-2023-7062", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:05:55.482Z", "dateReserved": "2023-12-21T17:26:28.697Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2024-07-10T02:02:46.771Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}