CVE-2023-2688: 
WordPress vulnerability analysis and mitigation

The WordPress File Upload and WordPress File Upload Pro plugins for WordPress contain a Path Traversal vulnerability (CVE-2023-2688) affecting versions up to and including 4.19.1. The vulnerability was discovered by Marco Wotschka and publicly disclosed on May 23, 2023 (Wordfence).

The vulnerability exists in the wfu_newpath parameter, which does not properly prevent attackers from modifying the target path to which the plugin will move files. The vulnerability has been assigned a CVSS v3.1 score of 4.9 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N (NVD).

This vulnerability allows administrator-level attackers to move files uploaded with the plugin (located in wp-content/uploads by default) outside of the web root. This could be particularly problematic in multisite configurations (WPScan).

The vulnerability requires administrator-level access to exploit, making it a relatively low-risk issue for most installations. However, in multisite configurations where administrator access is more commonly granted, the risk may be elevated (Wordfence).

The vulnerability has been patched in version 4.19.2 of the plugin. Users are advised to update to this version or later to mitigate the risk (WPScan).