Medium severity6.5NVD Advisory· Published Nov 6, 2023· Updated Jun 17, 2026

CVE-2023-4930

Description

The Front End PM WordPress plugin before 11.4.3 does not block listing the contents of the directories where it stores attachments to private messages, allowing unauthenticated visitors to list and download private attachments if the autoindex feature of the web server is enabled.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

WordPress/Front End Pminferred2 versions
<11.4.3+ 1 more
- (no CPE)range: <11.4.3
- (no CPE)range: <11.4.3
Package: https://wordpress.org/plugins/front-end-pm

Patches

Vulnerability mechanics

References

wpscan.com/vulnerability/c73b3276-e6f1-4f22-a888-025e5d0504f2nvdExploitThird Party Advisory

News mentions

No linked articles in our index yet.

cvss	0.423
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000