Medium severity · published Apr 10, 2023
CVE-2023-0156
All-In-One Security (AIOS) < 5.1.5 - Admin+ Arbitrary File/Folder Access via Traversal
4.9
CVSS
19.9%
EPSS
No
On KEV
Description
The All-In-One Security (AIOS) WordPress plugin before 5.1.5 does not limit what log files to display in it's settings pages, allowing an authorized user (admin+) to view the contents of arbitrary files and list directories anywhere on the server (to which the web server has access). The plugin only displays the last 50 lines of the file.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)19.9% · higher than 97% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AS
All-In-One Security (AIOS) ·
before 5.1.5 · source: vendor
AS
All-in-one Security · Updraftplus
before 5.1.5 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-0156
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-0156
Exploit
https://wpscan.com/vulnerability/caf1dbb5-197e-41e9-8f48-ba1f2360a759
More from All-In-One Security (AIOS)
7.5
CVE-2026-111739
Two Factor Authentication < 1.17.0 and All-In-One Security (AIOS) < 5.5.0 - Subscriber+ 2FA Bypass via 'creds_user_id' Parameter
5.3
CVE-2022-4346
All In One WP Security & Firewall < 5.1.3 - Configuration Leak
4.8
CVE-2023-0157
All-In-One Security (AIOS) < 5.1.5 - Admin+ Stored XSS