Medium severity6.5NVD Advisory· Published Aug 30, 2023· Updated Jun 17, 2026

CVE-2023-3720

Description

The Upload Media By URL WordPress plugin before 1.0.8 does not have CSRF check when uploading files, which could allow attackers to make logged in admins upload files (including HTML containing JS code for users with the unfiltered_html capability) on their behalf.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

WordPress/Upload Media By URLllm-create
Range: <1.0.8
Notetoservices/Upload Media By URL
cpe:2.3:a:notetoservices:upload_media_by_url:*:*:*:*:*:wordpress:*:*
Range: <1.0.8
WordPress/URL Media Uploadercpe-rescue
Package: https://wordpress.org/plugins/url-media-uploader

Patches

Vulnerability mechanics

References

wpscan.com/vulnerability/16375a7f-0a9f-4961-8510-d047ffbf3954nvdExploitThird Party Advisory

News mentions

No linked articles in our index yet.

cvss	0.423
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000