CVE-2023-0156
moderate-risk
Published 2023-04-10
The All-In-One Security (AIOS) WordPress plugin before 5.1.5 does not limit what log files to display in it's settings pages, allowing an authorized user (admin+) to view the contents of arbitrary files and list directories anywhere on the server (to which the web server has access). The plugin only displays the last 50 lines of the file.
Do I need to act?
!
43.1% chance of exploitation in next 30 days
EPSS score — higher than 57% of all CVEs
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
4
CVSS 4.9/10
Medium
NETWORK
/ LOW complexity
Affected Products (1)
Affected Vendors
42
/ 100
moderate-risk
Severity
20/34 · Moderate
Exploitability
17/34 · Moderate
Exposure
5/34 · Minimal