CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
What the vulnerability does
The Envolve Plugin plugin for WordPress is vulnerable to arbitrary file deletion in all versions up to, and including, 1.0 via the 'zetra_deleteLanguageFile' and 'zetra_deleteFontsFile' functions. This is due to the plugin not properly validating a file or its path prior to deleting it. This makes it possible for unauthenticated attackers to delete language files.
Explanation of Vulnerability in Simple Terms
The Envolve Plugin for ThemeKalia contains a path traversal vulnerability that allows an attacker to modify files on the site without authentication. By crafting a malicious request, an attacker can write or alter files outside the intended directory, potentially compromising site integrity. All versions up to 1.0 are affected.
What an attacker can do
Write or modify files on the site without needing to log in.
Potential impact on your site
An attacker can alter site files, potentially injecting malicious code or defacing content.
Conditions required to exploit
Network access to the site; no authentication or user interaction required.
Key dates
External resources
