CVE-2023-6636 is a high severity arbitrary file upload flaw in the Greenshift animation and page builder blocks plugin for WordPress. The gspb_save_files function does not validate file types, so a user with administrator access or above can upload files that may allow code execution. The record lists versions up to 7.6.2.
What's affected
- Product: Greenshift animation and page builder blocks, a WordPress plugin.
- Affected: versions up to and including 7.6.2, per the record.
- Fixed version: The record names none. A Trac changeset is linked; confirm the first release after 7.6.2 in the changelog.
- Role needed: administrator or above.
The record gives a CVSS 3.1 base score of 7.2 (high) with the vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. The CISA Known Exploited Vulnerabilities flag in the record is false. This post does not claim exploitation in the wild.
How to check if you're exposed
wp plugin list --fields=name,status,version
Find the plugin in the output and compare its version with the affected range above. If you do not use wp-cli, open the Plugins screen in the WordPress admin and read the version shown under the plugin name.
What to do now
- Check the plugin version on every WordPress site.
- Update to the first release after 7.6.2. Read the changelog on the plugin page to confirm the fix.
- Review accounts that hold the administrator role or above and remove any not needed.
- Look through the uploads directory and the plugin folders for PHP files or other files that should not be there.
- Disable PHP execution in the uploads directory at the web server.
- Run the free in-browser dependency scan at gold.safeguard.sh/scan on any project you build that bundles this component, and keep the result next to your inventory.
Why it matters
The record maps this issue to CWE-434 (Unrestricted Upload of File with Dangerous Type): The application accepts uploaded files without checking their type, so a file that the server can execute may be stored in a reachable place.
The record lists unrestricted upload of a file with a dangerous type. If an upload handler never checks what it is given, a file the server treats as a program can end up in a reachable folder, and requesting it runs it.
The needed role is high, so this is mostly a risk when a privileged account is stolen or when a privileged user is malicious. That matters on sites with several administrators, agency access or reused passwords. Blocking script execution in upload folders gives a layer that works across plugins.
Quick check
Can a visitor exploit this?
No. The record says the attacker must be authenticated with administrator level capabilities or above.
What is the first safe version?
The record says up to 7.6.2 is affected. Check the plugin changelog to confirm the first fixed release.
Sources
These are the references listed in the NVD record for this CVE. They were not fetched when this post was written, so confirm fixed versions in the advisory before acting.
- plugins.trac.wordpress.org
- plugins.trac.wordpress.org
- www.wordfence.com
- Gold entry for CVE-2023-6636
Last reviewed: 19 October 2026.
