CVE-2023-6925
published 2024-02-05CVE-2023-6925: The Unlimited Addons for WPBakery Page Builder plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation on the…
PriorityP278high7.2CVSS 3.1
AVNACLPRHUINSUCHIHAH
ITWVulnCheck KEVRansomware
Exploited in the wild
EPSS
1.50%
71.0th percentile
The Unlimited Addons for WPBakery Page Builder plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation on the 'importZipFile' function in versions up to, and including, 1.0.42. This makes it possible for authenticated attackers with a role that the administrator previously granted access to the plugin (the default is editor role, but access can also be granted to contributor role), to upload arbitrary files on the affected site's server which may make remote code execution possible.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| unitecms | unlimited_addons_for_wpbakery_page_builder | <= 1.0.42 | — |
CVSS provenance
nvdv3.17.2HIGHCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
vulncheck7.2HIGH
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Unlimited Addons for WPBakery Page Builder Plugin up to 1.0.42 on WordPress unrestricted upload
vuldb·2026-04-11·CVSS 7.2
CVE-2023-6925 [HIGH] Unlimited Addons for WPBakery Page Builder Plugin up to 1.0.42 on WordPress unrestricted upload
A vulnerability described as critical has been identified in Unlimited Addons for WPBakery Page Builder Plugin up to 1.0.42 on WordPress. Impacted is an unknown function. Executing a manipulation can lead to unrestricted upload.
This vulnerability is registered as CVE-2023-6925. It is possible to launch the attack remotely. No exploit is available.
GHSA
GHSA-mm24-rjwq-f95c: The Unlimited Addons for WPBakery Page Builder plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation o
ghsa_unreviewed·2024-02-06
CVE-2023-6925 [HIGH] CWE-434 GHSA-mm24-rjwq-f95c: The Unlimited Addons for WPBakery Page Builder plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation o
The Unlimited Addons for WPBakery Page Builder plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation on the 'importZipFile' function in versions up to, and including, 1.0.42. This makes it possible for authenticated attackers with a role that the administrator previously granted access to the plugin (the default is editor role, but access can also be granted to contributor role), to upload arbitrary files on the affected site's server which may make remote code execution possible.
VulnCheck
unitecms unlimited_addons_for_wpbakery_page_builder Unrestricted Upload of File with Dangerous Type
vulncheck·2023·CVSS 7.2
CVE-2023-6925 [HIGH] unitecms unlimited_addons_for_wpbakery_page_builder Unrestricted Upload of File with Dangerous Type
unitecms unlimited_addons_for_wpbakery_page_builder Unrestricted Upload of File with Dangerous Type
The Unlimited Addons for WPBakery Page Builder plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation on the 'importZipFile' function in versions up to, and including, 1.0.42. This makes it possible for authenticated attackers with a role that the administrator previously granted access to the plugin (the default is editor role, but access can also be granted to contributor role), to upload arbitrary files on the affected site's server which may make remote code execution possible.
Affected: unitecms unlimited_addons_for_wpbakery_page_builder
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the
No detection rules found.
No public exploits indexed.
Sentinelone
Dragon RaaS | Pro-Russian Hacktivist Group Aims to Build on "The Five Families" Cybercrime Reputation
blogs_sentinelone·2025-03-19
Dragon RaaS | Pro-Russian Hacktivist Group Aims to Build on "The Five Families" Cybercrime Reputation
Dragon RaaS is a ransomware group that walks the line between hacktivism and cybercrime. Also known as DragonRansom or Dragon Team, it emerged in July 2024 as an offshoot of the Stormous group, itself part of a larger cybercrime syndicate known as “The Five Families,” which includes ThreatSec, GhostSec , Blackforums, and SiegedSec .
While Dragon RaaS markets itself as a sophisticated Ransomware-as-a-Service (RaaS) operation, its attacks are often defacements and opportunistic rather than large-scale ransomware extortion. Even so, it continues to find victims—typically smaller organizations with weak security postures that are often compromised through misconfigurations, brute-force attacks and stolen credentials. The group primarily targets organizations in the United States, Israel, Unit
Sentinelone
Dragon RaaS | Pro-Russian Hacktivist Group Aims to Build on "The Five Families" Cybercrime Reputation
blogs_sentinelone·2025-03-19
Dragon RaaS | Pro-Russian Hacktivist Group Aims to Build on "The Five Families" Cybercrime Reputation
Dragon RaaS is a ransomware group that walks the line between hacktivism and cybercrime. Also known as DragonRansom or Dragon Team, it emerged in July 2024 as an offshoot of the Stormous group, itself part of a larger cybercrime syndicate known as “The Five Families,” which includes ThreatSec, GhostSec, Blackforums, and SiegedSec.
While Dragon RaaS markets itself as a sophisticated Ransomware-as-a-Service (RaaS) operation, its attacks are often defacements and opportunistic rather than large-scale ransomware extortion. Even so, it continues to find victims—typically smaller organizations with weak security postures that are often compromised through misconfigurations, brute-force attacks and stolen credentials. The group primarily targets organizations in the United States, Israel, United
https://plugins.trac.wordpress.org/browser/unlimited-addons-for-wpbakery-page-builder/trunk/inc_php/layouts/unitecreator_layouts_exporter.class.php?rev=2900676#L703https://www.wordfence.com/threat-intel/vulnerabilities/id/a78b76d6-4068-4141-9726-7db439aa6a9f?source=cvehttps://plugins.trac.wordpress.org/browser/unlimited-addons-for-wpbakery-page-builder/trunk/inc_php/layouts/unitecreator_layouts_exporter.class.php?rev=2900676#L703https://www.wordfence.com/threat-intel/vulnerabilities/id/a78b76d6-4068-4141-9726-7db439aa6a9f?source=cve
2024-02-05
Published
Exploited in the wild