CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
What the vulnerability does
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in FormAssembly / Drew Buschhorn WP-FormAssembly allows Path Traversal.This issue affects WP-FormAssembly: from n/a through 2.0.5.
Explanation of Vulnerability in Simple Terms
WP-FormAssembly versions up to 2.0.5 contain a path traversal vulnerability that allows authenticated users to read arbitrary files from the server. An attacker with a low-privilege account can access sensitive files outside the intended directory structure without user interaction. This exposes configuration files, database credentials, and other sensitive data stored on the server.
What an attacker can do
Read arbitrary files from the server, including configuration and credential files.
Potential impact on your site
Sensitive files like wp-config.php and database credentials may be exposed to any authenticated user.
Conditions required to exploit
Attacker must have a low-privilege user account on the site.
Key dates
External resources
Related vulnerabilities
