CVE-2023-4536 is a high severity (CVSS 8.8) arbitrary file upload in the My Account Page Editor WordPress plugin before version 1.3.2. Any signed in user, even a subscriber, can upload files and reach remote code execution. Update the plugin to 1.3.2 or later.
What's affected
The NVD record says the My Account Page Editor plugin, before 1.3.2, does not validate the profile picture being uploaded. Any authenticated user, such as a subscriber, can upload arbitrary files to the server, leading to remote code execution.
WPScan lists the fix as version 1.3.2 and adds a condition: the issue needs the Upload Profile Picture option to be enabled, which is not the default. If that option is off on your site, the described path is closed, but updating is still the right move.
The record names koalaapps:my_account_page_editor as the product. The plugin is a front end customisation tool, so it is often installed on membership and shop sites where many people hold low privilege accounts. That raises the number of people who could try the upload.
How to check if you're exposed
With WP-CLI, list plugins and read the version column.
wp plugin list --format=table
wp plugin get my-account-page-editor --fields=name,status,version
Then check the plugin settings for the profile picture upload option. Also inspect the uploads directory for files with executable extensions, such as PHP files, that should never be there.
Review recent subscriber accounts for sign ups you do not recognise, since the attacker only needs a basic login.
What to do now
- Update My Account Page Editor to 1.3.2 or later on every site.
- If you do not need profile picture uploads, turn that option off.
- Scan the uploads folder for script files and remove anything unexpected, then investigate how it got there.
- Block script execution in the uploads directory at the web server.
- Review user registrations and remove accounts that look automated.
Why it matters
The weakness is CWE-434, unrestricted upload of a file with a dangerous type. The server accepts a file as a picture without checking that it is one, and stores it where the web server may run it.
This is a well known class, and the usual repairs are to check the file type by content, rename files, store them outside the web root and refuse script execution in upload folders. It becomes serious on open registration sites, because the starting privilege is trivial to get. The record does not claim exploitation in the wild and the CVE is not in the CISA KEV catalog.
Quick check
Am I exposed if profile picture uploads are off?
WPScan says the issue needs that option enabled, and it is off by default. Update anyway, because settings change over time.
Sources
Last reviewed: 19 October 2026.
