CVE-2023-6827: 
WordPress vulnerability analysis and mitigation

The Essential Real Estate plugin for WordPress (CVE-2023-6827) contains a critical vulnerability in versions up to and including 4.3.5. The vulnerability was discovered and disclosed on December 15, 2023, affecting the plugin's ajaxUploadFonts function due to insufficient file type validation (NVD CVE).

The vulnerability is classified as an Unrestricted Upload of File with Dangerous Type (CWE-434). It has received a CVSS v3.1 base score of 8.8 (HIGH) from NIST with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, while Wordfence assigned a score of 7.5 (HIGH) with vector string CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H (NVD CVE).

The vulnerability allows authenticated attackers with subscriber-level capabilities or above to upload arbitrary files to the affected site's server. This could potentially lead to remote code execution, compromising the entire WordPress installation (NVD CVE).

The vulnerability requires authentication with at least subscriber-level access, making it exploitable by any authenticated user on the WordPress site. The attack vector is network-accessible and requires low attack complexity according to the CVSS scoring (NVD CVE).

A patch has been released to address this vulnerability. Site administrators should update their Essential Real Estate plugin to a version newer than 4.3.5 (WordPress Patch).