CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
What the vulnerability does
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in RadiusTheme ShopBuilder – Elementor WooCommerce Builder Addons shopbuilder.This issue affects ShopBuilder – Elementor WooCommerce Builder Addons: from n/a through <= 2.1.12.
Explanation of Vulnerability in Simple Terms
ShopBuilder for Elementor contains a flaw that allows authenticated users with low privileges to read sensitive data they should not access. The vulnerability stems from improper access controls on data retrieval functions. An attacker with a basic user account can view confidential information without additional interaction. Site administrators should update to a patched version immediately.
What an attacker can do
Read sensitive data accessible only to higher-privilege users or administrators.
Potential impact on your site
Customer data, admin settings, or other confidential information may be exposed to low-privilege users.
Conditions required to exploit
Attacker must have a low-privilege user account on the site (e.g., subscriber or customer).
Key dates
External resources
Related vulnerabilities
