CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
What the vulnerability does
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Blue Plugins Events Calendar for Google allows PHP Local File Inclusion.This issue affects Events Calendar for Google: from n/a through 2.1.0.
Explanation of Vulnerability in Simple Terms
Events Calendar for Google through version 2.1.0 contains a path traversal vulnerability that allows authenticated users to read arbitrary files from the server. An attacker with low-level plugin access can bypass directory restrictions and access sensitive files outside the intended plugin directory. This exposes configuration files, database credentials, and other sensitive data stored on the server.
What an attacker can do
Read arbitrary files from the server, including configuration and credential files.
Potential impact on your site
Sensitive server files and credentials may be exposed to authenticated users with minimal privileges.
Conditions required to exploit
Attacker must have a low-level authenticated account on the site (e.g., subscriber or contributor role).
Key dates
External resources
Related vulnerabilities
