CVE-2023-34381
Description
Missing Authorization vulnerability in Gesundheit Bewegt GmbH Zippy allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Zippy: from n/a through 1.6.2.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
1- Range: <=1.6.2
Patches
Vulnerability mechanics
Root cause
"Missing authorization check in the archive import functionality allows unauthenticated arbitrary file upload."
Attack vector
An unauthenticated attacker can send a crafted HTTP request to the Zippy plugin's archive import endpoint without any authentication or authorization [CWE-862]. The plugin fails to verify user capabilities before processing uploaded zip archives, allowing arbitrary file uploads. The attacker can upload a malicious zip file containing PHP code, which the plugin then extracts into the WordPress uploads directory, leading to remote code execution. The CVSS vector confirms the attack is network-based, requires no privileges, and needs no user interaction.
Affected code
The Zippy WordPress plugin (versions through 1.6.2) lacks authorization checks on its archive import functionality. The plugin's archive import endpoint does not verify that the requesting user has the required capabilities before processing uploaded zip files.
What the fix does
The patch in version 1.7.0 adds proper capability checks (authorization) before allowing archive import operations. It also introduces CSRF nonce verification, path traversal protection, and a whitelist-based file extension validation to prevent arbitrary file uploads. These changes ensure that only authenticated users with appropriate permissions can import archives, closing the missing authorization vulnerability.
Preconditions
- authNo authentication required; the endpoint is accessible to unauthenticated users
- configThe WordPress Zip extension must be enabled on the server
- networkAttacker must be able to send HTTP requests to the WordPress installation
Generated on Jun 19, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.
References
1News mentions
0No linked articles in our index yet.