CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
What the vulnerability does
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Ex-Themes WP Timeline – Vertical and Horizontal timeline plugin wp-timelines.This issue affects WP Timeline – Vertical and Horizontal timeline plugin: from n/a through <= 3.6.7.
Explanation of Vulnerability in Simple Terms
The WP Timeline plugin for WordPress contains a code injection vulnerability affecting versions up to 3.6.7. An attacker can inject and execute arbitrary code on the site without authentication. The vulnerability requires specific conditions to trigger but allows full control over the site once exploited. Site administrators should update immediately to a patched version.
What an attacker can do
Run arbitrary code on the site and take full control of it.
Potential impact on your site
Complete site compromise, data theft, malware installation, and loss of user data.
Conditions required to exploit
Network access to the site; specific attack conditions must be met (high complexity).
Key dates
External resources
Related vulnerabilities
