CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
What the vulnerability does
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Wow-Company Easy Digital Downloads – Recent Purchases allows PHP Remote File Inclusion.This issue affects Easy Digital Downloads – Recent Purchases: from n/a through 1.0.2.
Explanation of Vulnerability in Simple Terms
Easy Digital Downloads – Recent Purchases plugin versions up to 1.0.2 contain a vulnerability that allows an attacker to read sensitive data, modify site content, or disrupt service. The attack requires a victim to click a malicious link or visit a compromised page. The vulnerability affects the entire site, not just the plugin.
What an attacker can do
Read sensitive data, modify site content, or disrupt service by tricking a user into clicking a link.
Potential impact on your site
Site data and functionality can be compromised if a user visits a malicious link while logged in or browsing.
Conditions required to exploit
Victim must click a malicious link or visit an attacker-controlled page; no authentication required.
Key dates
External resources
Related vulnerabilities
