CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
What the vulnerability does
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in istmoplugins Instant Chat Floating Button for WordPress Websites instant-chat-wp allows PHP Local File Inclusion.This issue affects Instant Chat Floating Button for WordPress Websites: from n/a through <= 1.0.5.
Explanation of Vulnerability in Simple Terms
The Instant Chat Floating Button plugin for WordPress versions 1.0.5 and earlier contains a path traversal vulnerability that allows an attacker to read arbitrary files from the server. An attacker can craft a malicious link that, when clicked by a site visitor, exposes sensitive files like configuration files containing database credentials. This requires user interaction but can compromise the entire site.
What an attacker can do
Read arbitrary files from the server, including configuration files with database credentials and other sensitive data.
Potential impact on your site
Attackers can access sensitive files like wp-config.php, potentially leading to full site compromise and data theft.
Conditions required to exploit
A site visitor must click a malicious link crafted by the attacker; no authentication required.
Key dates
External resources
Related vulnerabilities
