CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
What the vulnerability does
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Crocoblock JetWidgets for Elementor and WooCommerce allows PHP Local File Inclusion.This issue affects JetWidgets for Elementor and WooCommerce: from n/a through 1.1.7.
Explanation of Vulnerability in Simple Terms
JetWidgets for Elementor and WooCommerce versions up to 1.1.7 contain a path traversal vulnerability that allows authenticated users to read files outside the intended directory. An attacker with low-level site access can view sensitive files on the server by manipulating file paths. This affects confidentiality but not data integrity or availability.
What an attacker can do
Read arbitrary files on the server outside the intended directory.
Potential impact on your site
Sensitive files (config, database credentials, private keys) may be exposed to low-privilege users.
Conditions required to exploit
Attacker must have a low-privilege user account on the site (e.g., subscriber or contributor).
Key dates
External resources
Related vulnerabilities
