CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
What the vulnerability does
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Hung Trang Si SB Random Posts Widget sb-random-posts-widget allows PHP Local File Inclusion.This issue affects SB Random Posts Widget: from n/a through <= 1.0.
Explanation of Vulnerability in Simple Terms
SB Random Posts Widget versions 1.0 and earlier contain a code injection vulnerability. An attacker with low-level site access can inject and execute arbitrary code, gaining full control over the site's data and functionality. The vulnerability requires network access and some technical setup but does not require user interaction. Sites running this widget should update immediately.
What an attacker can do
Run arbitrary code on the site and access or modify all site data.
Potential impact on your site
Complete site compromise: attacker can steal data, modify content, create admin accounts, or take the site offline.
Conditions required to exploit
Attacker needs low-level site access (e.g., subscriber or contributor account); network access required.
Key dates
External resources
Related vulnerabilities
