Read the docs
TI-2023-05300 Aliases CVE-2023-5762GHSA-wpgp-69jp-wj64

Filr – Secure document library < 1.2.3.6 - Author+ RCE via file upload with phar ext

Priority MEDIUM 42CWE-94Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-94.

Summary

The Filr WordPress plugin before 1.2.3.6 is vulnerable from an RCE (Remote Code Execution) vulnerability, which allows the operating system to execute commands and fully compromise the server on behalf of a user with Author-level privileges.

Why it matters now

EPSS 0.02024 81st percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA and NVD
Fix Fixed Filr (Unknown): 1.2.3.6

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
UnknownFilrbefore 1.2.3.61.2.3.6Patch availableCNA
  • Filr VendorUnknown Affected before 1.2.3.6 Fixed in 1.2.3.6 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:filr_project:filr:*:*:*:*:*:wordpress:*:*before 1.2.3.6VulnerableFilr Project
  • cpe:2.3:a:filr_project:filr:*:*:*:*:*:wordpress:*:* Versions before 1.2.3.6 Vulnerable ·Filr Project

Remediation

  • Fix · CNA Filr (Unknown) Fixed in 1.2.3.6

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-5762
  2. 2026-10-03 Alias added: GHSA-wpgp-69jp-wj64

References

Exploit 1

  • TI-2022-01643 Filr - Secure Document Library < 1.2.2.1 - Subscriber+ AJAX Calls CVSS 3.1HIGH 8.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences