CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
What the vulnerability does
The Advanced File Manager Shortcodes plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.4. This makes it possible for attackers with contributor access or higher to read the contents of arbitrary files on the server, which can contain sensitive information.
Explanation of Vulnerability in Simple Terms
Advanced File Manager Shortcodes versions 2.4 and earlier contain a vulnerability allowing authenticated users with low privileges to read, modify, or delete files on the site. The vulnerability requires a valid user account but no special permissions. An attacker can exploit this to access sensitive data, alter site content, or disrupt availability.
What an attacker can do
Read, modify, or delete files on the site with the privileges of the web server.
Potential impact on your site
Any registered user can potentially access or alter sensitive files, including configuration and database backups.
Conditions required to exploit
Attacker must have a low-privilege user account on the site; no user interaction required.
Key dates
External resources
Related vulnerabilities
