CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
What the vulnerability does
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in wpdev33 WP Newsletter Subscription wp-newsletter-subscription allows PHP Local File Inclusion.This issue affects WP Newsletter Subscription: from n/a through <= 1.1.
Explanation of Vulnerability in Simple Terms
WP Newsletter Subscription versions 1.1 and earlier contain a path traversal vulnerability that allows an attacker to read or modify arbitrary files on the server. The vulnerability requires the attacker to trick a site visitor into clicking a malicious link. An attacker can access sensitive files like configuration files containing database credentials or modify site files to inject malicious code.
What an attacker can do
Read or modify arbitrary files on the server, including sensitive configuration and code files.
Potential impact on your site
Attackers could steal database credentials, modify site files, or inject malicious code without needing a WordPress account.
Conditions required to exploit
No authentication required, but the victim must click a malicious link or visit an attacker-controlled page.
Key dates
External resources
Related vulnerabilities
