CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:L
What the vulnerability does
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in QODE Interactive Qi Addons For Elementor allows PHP Local File Inclusion.This issue affects Qi Addons For Elementor: from n/a through 1.6.3.
Explanation of Vulnerability in Simple Terms
Qi Addons For Elementor versions up to 1.6.3 contain a path traversal vulnerability that allows authenticated users with low privileges to read files outside the intended directory. An attacker can also make limited modifications to files on the server. The vulnerability requires network access and some technical knowledge to exploit, but does not require user interaction.
What an attacker can do
Read arbitrary files on the server and make limited modifications to file content.
Potential impact on your site
Sensitive files (config, database credentials, private keys) may be exposed; site files could be partially modified.
Conditions required to exploit
Attacker must have a low-privilege user account on the site; network access required.
Key dates
External resources
Related vulnerabilities
