CVE-2023-5762: 
WordPress vulnerability analysis and mitigation

The Filr WordPress plugin before version 1.2.3.6 contains a Remote Code Execution (RCE) vulnerability that allows users with Author-level privileges to execute operating system commands and potentially fully compromise the server (WPScan, NVD). The vulnerability was publicly disclosed on November 13, 2023.

The vulnerability is classified as a Code Injection (CWE-94) with a CVSS v3.1 base score of 8.8 HIGH (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The issue allows attackers to upload files with the 'phar' extension containing malicious code through the plugin's dashboard, which can then be executed via the WordPress uploads directory (WPScan).

If exploited, this vulnerability allows attackers with Author-level access to execute arbitrary operating system commands, potentially leading to full server compromise. The attacker can gain complete control over the affected WordPress installation and potentially the underlying server (NVD, WPScan).

The vulnerability is exploitable by accessing the plugin's dashboard, uploading a file with a 'phar' extension containing malicious code, and accessing it through the WordPress uploads directory. A proof of concept exists demonstrating the execution of system commands like 'ps aux' or 'pwd' through the uploaded file (WPScan).

Users should immediately upgrade to Filr WordPress plugin version 1.2.3.6 or later, which contains fixes for this vulnerability (WPScan).