CVE-2023-5762: The Filr WordPress plugin before 1.2.3.6 is vulnerable from an RCE (Remote Code Execution) vulnerability, which allows the operating system to execute commands and fully compromise the server on behal

high Affects filr (WordPress plugin). Feed 2026.10.29.1, updated 2026-10-28; published 2023-12-04; advisory modified 2026-06-17.

The Filr WordPress plugin before 1.2.3.6 is vulnerable from an RCE (Remote Code Execution) vulnerability, which allows the operating system to execute commands and fully compromise the server on behal

Package: filr (WordPress plugin) WordPress
Affected versions: <1.2.3.6
Fixed in: 1.2.3.6
Severity: high CVSS 8.8
Exploitation: not on CISA KEV · EPSS 2% (80.9th percentile)
Published: 2023-12-04
Source: nvd

References

CWE-94

NVD record filr (WordPress plugin) advisories

Am I affected?

Find out in one command. phpwarden checks your WordPress install against this advisory and 20,000+ others, ranked by real-world exploitation (CISA KEV + EPSS). Free, offline, open data.

# one-time install
pip install phpwarden

# then
phpwarden wordpress /var/www/html

Or keep it checked automatically with the GitHub Action or a nightly cron; see WordPress docs.

Install docs How findings are ranked

Related advisories

CVE-2022-1777 high The Filr WordPress plugin before 1.2.2.1 does not have authorisation check in two of its A same package: filr (WordPress plugin)
CVE-2017-9841 KEV critical Code Injection in PHPUnit same weakness: CWE-94
CVE-2021-3129 KEV critical Unauthenticated remote code execution via insecure file handling in debug mode same weakness: CWE-94
CVE-2025-32432 KEV critical Craft CMS Allows Remote Code Execution same weakness: CWE-94
CVE-2018-7602 KEV critical A remote code execution vulnerability exists within multiple subsystems of Drupal 7.x and same weakness: CWE-94
CVE-2024-56145 KEV critical Craft CMS has potential RCE when PHP `register_argc_argv` config setting is enabled same weakness: CWE-94