CVE-2023-47846: 
WordPress vulnerability analysis and mitigation

The WP Githuber MD WordPress plugin contains an Unrestricted Upload of File with Dangerous Type vulnerability (CVE-2023-47846) affecting versions up to and including 1.16.2. The vulnerability was discovered by Rafie Muhammad and publicly disclosed on November 20, 2023. This security issue affects the WordPress Markdown Editor plugin developed by Terry Lin (WPScan, Patchstack).

The vulnerability is classified as CWE-434 (Unrestricted Upload of File with Dangerous Type) and has received a CVSS v3.1 base score of 9.1 (Critical) with the vector string CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H. The issue requires author-level privileges or higher to exploit (Patchstack).

The vulnerability allows authenticated attackers with author access or higher privileges to upload arbitrary files to the affected site's server, potentially enabling remote code execution. This could lead to complete compromise of the affected website (WPScan).

The vulnerability requires authentication with author-level access or higher to exploit. According to Patchstack, the vulnerability is considered moderately dangerous and is expected to become exploited (Patchstack).

Users are advised to update to version 1.16.3 or later to resolve the vulnerability. Patchstack has issued a virtual patch to mitigate this issue by blocking any attacks until users can update to a fixed version (Patchstack).