CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
What the vulnerability does
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), Deserialization of Untrusted Data vulnerability in BdThemes Element Pack Pro allows Path Traversal, Object Injection.This issue affects Element Pack Pro: from n/a before 7.19.3.
Explanation of Vulnerability in Simple Terms
Element Pack Pro versions before 7.19.3 contain a path traversal vulnerability that allows authenticated users with low privileges to read, modify, or delete arbitrary files on the server. The vulnerability requires specific attack conditions but can affect the entire site if exploited. Update to version 7.19.3 or later immediately.
What an attacker can do
Read, modify, or delete arbitrary files on the server, potentially compromising the entire site.
Potential impact on your site
An authenticated attacker can access sensitive files, alter site configuration, or cause data loss.
Conditions required to exploit
Attacker must have a low-privilege authenticated account; no user interaction required.
Key dates
External resources
Related vulnerabilities
