CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
What the vulnerability does
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in snstheme BodyCenter - Gym, Fitness WooCommerce WordPress Theme allows PHP Local File Inclusion. This issue affects BodyCenter - Gym, Fitness WooCommerce WordPress Theme: from n/a through 2.4.
Explanation of Vulnerability in Simple Terms
BodyCenter is a WordPress theme for fitness and gym sites. Versions up to 2.4 contain a code injection vulnerability that allows unauthenticated attackers to run their own PHP code on the site. The vulnerability requires specific conditions to exploit but can lead to complete site compromise, including data theft and malware installation.
What an attacker can do
Run arbitrary PHP code on the site without authentication.
Potential impact on your site
Complete site compromise: attackers can steal data, modify content, install malware, or take full control.
Conditions required to exploit
Network access to the site; specific attack conditions must be met (high complexity).
Key dates
External resources
Related vulnerabilities
