CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
What the vulnerability does
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Select-Themes Stockholm Core allows PHP Local File Inclusion.This issue affects Stockholm Core: from n/a through 2.4.1.
Explanation of Vulnerability in Simple Terms
Stockholm Core contains a path traversal vulnerability that allows authenticated users with low privileges to read, modify, or delete arbitrary files on the server. The vulnerability requires network access and high attack complexity, but once exploited, can compromise the entire site's confidentiality, integrity, and availability. Site administrators should update to a patched version immediately.
What an attacker can do
Read, modify, or delete arbitrary files on the server.
Potential impact on your site
An authenticated attacker can access sensitive files, alter site configuration, or disable the site entirely.
Conditions required to exploit
Attacker must have a low-privilege authenticated account; no user interaction required.
Key dates
External resources
Related vulnerabilities
