CVE-2023-0156: The All-In-One Security (AIOS) WordPress plugin before 5.1.5 does not limit what log files to display in it's settings pages, allowing an authorized user…

PriorityP339medium4.9CVSS 3.1

AVNACLPRHUINSUCHINAN

EPSS

19.92%

97.1th percentile

The All-In-One Security (AIOS) WordPress plugin before 5.1.5 does not limit what log files to display in it's settings pages, allowing an authorized user (admin+) to view the contents of arbitrary files and list directories anywhere on the server (to which the web server has access). The plugin only displays the last 50 lines of the file.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
updraftplus	all-in-one_security	< 5.1.5	5.1.5

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.