CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
What the vulnerability does
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in StylemixThemes Consulting Elementor Widgets allows PHP Local File Inclusion.This issue affects Consulting Elementor Widgets: from n/a through 1.3.0.
Explanation of Vulnerability in Simple Terms
Consulting Elementor Widgets versions up to 1.3.0 contain a path traversal vulnerability that allows authenticated users with low privileges to read, modify, or delete arbitrary files on the server. The vulnerability requires network access and high attack complexity, but can affect the entire site if exploited. Site administrators should update immediately to a patched version.
What an attacker can do
Read, modify, or delete arbitrary files on the server outside the intended directory.
Potential impact on your site
Attackers with basic user accounts can access sensitive files, alter site configuration, or cause data loss.
Conditions required to exploit
Attacker must have a low-privilege user account on the site; no user interaction required.
Key dates
External resources
Related vulnerabilities
