CVE-2023-2688: The WordPress File Upload and WordPress File Upload Pro plugins for WordPress are vulnerable to Path Traversal in versions up to, and including, 4.19.1 via the vulnerable parameter wfu_newpath. This a

medium Affects wordpress-file-upload (WordPress plugin), wordpress-file-upload-pro (WordPress plugin). Feed 2026.10.29.1, updated 2026-10-28; published 2023-06-09; advisory modified 2026-06-17.

The WordPress File Upload and WordPress File Upload Pro plugins for WordPress are vulnerable to Path Traversal in versions up to, and including, 4.19.1 via the vulnerable parameter wfu_newpath. This a

Package: wordpress-file-upload (WordPress plugin) WordPress
Affected versions: <=4.19.1
Fixed in: no fix recorded
Severity: medium CVSS 4.9
Exploitation: not on CISA KEV · EPSS 2% (77.6th percentile)
Published: 2023-06-09
Source: nvd

References

The WordPress File Upload and WordPress File Upload Pro plugins for WordPress are vulnerable to Path Traversal in versions up to, and including, 4.19.1 via the vulnerable parameter wfu_newpath. This a

Package: wordpress-file-upload-pro (WordPress plugin) WordPress
Affected versions: <=4.19.1
Fixed in: no fix recorded
Severity: medium CVSS 4.9
Exploitation: not on CISA KEV · EPSS 2% (77.6th percentile)
Published: 2023-06-09
Source: nvd

References

CWE-22

NVD record wordpress-file-upload (WordPress plugin) advisories wordpress-file-upload-pro (WordPress plugin) advisories

Am I affected?

Find out in one command. phpwarden checks your WordPress install against this advisory and 20,000+ others, ranked by real-world exploitation (CISA KEV + EPSS). Free, offline, open data.

# one-time install
pip install phpwarden

# then
phpwarden wordpress /var/www/html

Or keep it checked automatically with the GitHub Action or a nightly cron; see WordPress docs.

Install docs How findings are ranked

Related advisories

CVE-2024-6651 medium The WordPress File Upload WordPress plugin before 4.24.8 does not sanitise and escape a pa same package: wordpress-file-upload (WordPress plugin)
CVE-2024-11613 critical The WordPress File Upload plugin for WordPress is vulnerable to Remote Code Execution, Arb same package: wordpress-file-upload (WordPress plugin)
CVE-2021-24962 high The WordPress File Upload Free and Pro WordPress plugins before 4.16.3 allow users with a same package: wordpress-file-upload (WordPress plugin)
CVE-2024-11635 critical The WordPress File Upload plugin for WordPress is vulnerable to Remote Code Execution in a same package: wordpress-file-upload (WordPress plugin)
CVE-2021-24960 medium The WordPress File Upload WordPress plugin before 4.16.3, wordpress-file-upload-pro WordPr same package: wordpress-file-upload (WordPress plugin)
CVE-2021-24961 medium The WordPress File Upload WordPress plugin before 4.16.3, wordpress-file-upload-pro WordPr same package: wordpress-file-upload (WordPress plugin)