CVE-2023-48275 HIGH

CVE-2023-48275: WordPress Widgets for Google Reviews plugin <= 11.0.2 - Arbitrary File Upload vulnerability

Vendor Trustindex.io
Product Widgets for Google Reviews
Weakness CWE-434 · Unrestricted file upload
Published March 26, 2024
Last update April 28, 2026
View on NVD All CVEs

CVSS base score

8.0/10
Attack vector Network
Attack complexity High
Privileges required High
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

What the vulnerability does

01Description

Unrestricted Upload of File with Dangerous Type vulnerability in Trustindex.Io Widgets for Google Reviews.This issue affects Widgets for Google Reviews: from n/a through 11.0.2.

Explanation of Vulnerability in Simple Terms

02Summary

Trustindex.io Widgets for Google Reviews versions up to 11.0.2 do not properly validate file uploads, allowing administrators to upload malicious files to the site. An attacker with admin access can upload files that execute code, modify site content, or disrupt service. The vulnerability requires high-level privileges and affects the entire site scope.

What an attacker can do

03Attacker Capabilities

Upload and execute malicious files on the site with admin-level access.

Potential impact on your site

04Site Impact

A compromised admin account can upload files that run code, steal data, or take the site offline.

Conditions required to exploit

05Prerequisites

Attacker must have administrator privileges on the WordPress site.

Key dates

06Disclosure timeline

March 26, 2024 CVE published
April 28, 2026 Record updated

Related vulnerabilities

08Related CVE

CVE-2018-25436 WordPress Plugin Baggage Freight Shipping Australia 0.1.0 Arbitrary File Upload CVE-2026-14489 WHMCS Bridge <= 6.9 - Unauthenticated Arbitrary File Upload via 'ccce' Parameter CVE-2026-65885 Joomla Extension - balbooa.com - Authenticated arbitrary file upload in Gridbox < 2.20.2 CVE-2026-57719 WordPress Aimogen Pro plugin <= 2.8.3 - Arbitrary File Upload vulnerability CVE-2026-14270 Extra Checkout Options (addon for Extra Product Options & Add-Ons for WooCommerce) <= 2.3.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Upload in eco_save_settings