CVE-2023-4536: Koalaapps My Account Page Editor

High severity, CVSS 8.8. EPSS: 1% chance of exploitation in the next 30 days.

The My Account Page Editor WordPress plugin before 1.3.2 does not validate the profile picture to be uploaded, allowing any authenticated users, such as subscriber to upload arbitrary files to the server, leading to RCE

Affected products

• Koalaapps My Account Page Editor: before 1.3.2 (fixed in 1.3.2)

Published 2024-01-16. Last modified 2026-06-17.