CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
What the vulnerability does
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in wpWax Product Carousel Slider & Grid Ultimate for WooCommerce woo-product-carousel-slider-and-grid-ultimate.This issue affects Product Carousel Slider & Grid Ultimate for WooCommerce: from n/a through <= 1.9.10.
Explanation of Vulnerability in Simple Terms
Product Carousel Slider & Grid Ultimate for WooCommerce versions up to 1.9.10 contain an information disclosure vulnerability. An authenticated user with low privileges can read sensitive data they should not have access to. The vulnerability requires network access and no user interaction beyond the attacker's own actions. Update to a version newer than 1.9.10 to resolve this issue.
What an attacker can do
Read sensitive data from the site that should be restricted to higher-privilege users.
Potential impact on your site
Customer data, product information, or other sensitive content may be exposed to low-privilege users.
Conditions required to exploit
Attacker must have a low-privilege account on the site (e.g., subscriber or customer role).
Key dates
External resources
Related vulnerabilities
