CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
What the vulnerability does
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in WP OnlineSupport, Essential Plugin Timeline and History slider allows PHP Local File Inclusion.This issue affects Timeline and History slider: from n/a through 2.3.
Explanation of Vulnerability in Simple Terms
The Timeline and History slider plugin for WordPress contains a path traversal vulnerability that allows authenticated users with low privileges to read arbitrary files from the server. An attacker can bypass directory restrictions and access sensitive files outside the intended plugin directory. The vulnerability requires network access and low-level authentication but can result in exposure of configuration files, database credentials, and other sensitive data.
What an attacker can do
Read arbitrary files from the server, including configuration files and sensitive data outside the plugin directory.
Potential impact on your site
Sensitive files like wp-config.php, database backups, and private keys may be exposed to authenticated attackers.
Conditions required to exploit
Attacker must have a low-privilege WordPress user account (e.g., subscriber or contributor role).
Key dates
External resources
Related vulnerabilities
