CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
What the vulnerability does
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in CridioStudio ListingPro listingpro-plugin allows PHP Local File Inclusion.This issue affects ListingPro: from n/a through <= 2.9.4.
Explanation of Vulnerability in Simple Terms
ListingPro versions up to 2.9.4 contain a path traversal vulnerability that allows high-privileged users to read or write arbitrary files on the server. An attacker with admin or elevated access can bypass file system restrictions and access sensitive data outside the intended directory structure. The vulnerability affects confidentiality, integrity, and availability of the site.
What an attacker can do
Read or write arbitrary files on the server filesystem.
Potential impact on your site
A compromised admin account could expose sensitive files, modify core files, or disable the site entirely.
Conditions required to exploit
Attacker must have high-level privileges (admin or equivalent role) on the site.
Key dates
External resources
Related vulnerabilities
