CVE-2023-6140: Essential Real Estate < 4.4 - Subscriber+ Arbitrary File Upload

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.1% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2024-01-08 · updated 2026-06-17
Weakness: CWE-434

Description

The Essential Real Estate WordPress plugin before 4.4.0 does not prevent users with limited privileges on the site, like subscribers, from momentarily uploading malicious PHP files disguised as ZIP archives, which may lead to remote code execution.

Affected products

g5theme Essential Real Estate: before 4.4.0 — fixed in 4.4.0

How to fix

Upgrade to a fixed version: g5theme Essential Real Estate 4.4.0. Check the vendor advisory for mitigations.

References

https://wpscan.com/vulnerability/c837eaf3-fafd-45a2-8f5e-03afb28a765b
https://wpscan.com/vulnerability/c837eaf3-fafd-45a2-8f5e-03afb28a765b

Get alerted when CVE-2023-6140 or the next vulnerability affects your stack