cve/2023/CVE-2023-5604.md

### [CVE-2023-5604](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-5604)
![](https://img.shields.io/static/v1?label=Product&message=Asgaros%20Forum&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=0%3C%202.7.1%20&color=brighgreen)
![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-434%20Unrestricted%20Upload%20of%20File%20with%20Dangerous%20Type&color=brighgreen)

### Description

The Asgaros Forum WordPress plugin before 2.7.1 allows forum administrators, who may not be WordPress (super-)administrators, to set insecure configuration that allows unauthenticated users to upload dangerous files (e.g. .php, .phtml), potentially leading to remote code execution.

### POC

#### Reference
- https://wpscan.com/vulnerability/4ce69d71-87bf-4d95-90f2-63d558c78b69

#### Github
No PoCs found on GitHub currently.