CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
What the vulnerability does
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in DynamicWebLab WordPress Team Manager allows PHP Local File Inclusion.This issue affects WordPress Team Manager: from n/a through 2.1.12.
Explanation of Vulnerability in Simple Terms
The WordPress Team Manager plugin through version 2.1.12 contains a path traversal vulnerability that allows authenticated users to read arbitrary files from the server. An attacker with a low-privilege account can bypass directory restrictions and access sensitive files outside the intended plugin directory. This could expose configuration files, database credentials, or other sensitive data stored on the server.
What an attacker can do
Read arbitrary files from the server, including configuration and credential files.
Potential impact on your site
Sensitive server files and credentials may be exposed to any authenticated user, risking data breach.
Conditions required to exploit
Attacker must have a low-privilege WordPress user account (subscriber or higher).
Key dates
External resources
Related vulnerabilities
