CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N
What the vulnerability does
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Web-Settler Landing Page Builder – Free Landing Page Templates allows Path Traversal.This issue affects Landing Page Builder – Free Landing Page Templates: from n/a through 3.1.9.9.
Explanation of Vulnerability in Simple Terms
An authenticated administrator can read arbitrary files from the server by manipulating file paths in requests to the Landing Page Builder plugin. The vulnerability exploits insufficient path validation, allowing access to sensitive files outside the intended directory. This affects versions up to 3.1.9.9. No user interaction is required once an admin account is compromised or available.
What an attacker can do
Read arbitrary files from the server, including configuration files and other sensitive data.
Potential impact on your site
An attacker with admin credentials can access sensitive files like wp-config.php, database backups, or private keys.
Conditions required to exploit
Administrator-level access to the WordPress site; network access to the plugin.
Key dates
External resources
Related vulnerabilities
