CVE-2023-29386: 
WordPress vulnerability analysis and mitigation

CVE-2023-29386 is an Unrestricted Upload of File with Dangerous Type vulnerability affecting the Manager for Icomoon WordPress plugin versions up to 2.0. The vulnerability was discovered by researcher deokhunKim and was publicly disclosed on May 8, 2023 (WPScan, Patchstack).

The vulnerability stems from the plugin's failure to properly validate files during the upload process via its upload() function. This allows unauthenticated users to upload archive files containing malicious PHP code, which can then be extracted on the blog. The vulnerability has received a CVSS v3.1 score of 9.1 (Critical) with the vector string CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H (Patchstack).

The vulnerability could allow malicious actors to upload any type of file to the affected website, including backdoors that can be executed to gain further access to the website. This could potentially lead to complete website compromise (Patchstack).

The vulnerability is classified as having low complexity (AC:L) and requires no user interaction (UI:N) to exploit, though it does require high privileges (PR:H). The attack vector is network-accessible (AV:N), making it possible to exploit remotely (Patchstack).

The vulnerability has been fixed in version 2.1 of the Manager for Icomoon plugin. Users are advised to update to version 2.1 or later to remove the vulnerability. Additionally, Patchstack has issued a virtual patch to mitigate this issue by blocking any attacks until users can update to a fixed version (Patchstack).