CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
What the vulnerability does
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AbsolutePlugins Absolute Addons For Elementor absolute-addons allows Local Code Inclusion.This issue affects Absolute Addons For Elementor: from n/a through <= 1.0.14.
Explanation of Vulnerability in Simple Terms
Absolute Addons For Elementor versions up to 1.0.14 contain a code injection vulnerability that allows authenticated attackers to execute arbitrary PHP code on the site. The vulnerability requires low-level user privileges and high attack complexity, but successful exploitation grants full control over site functionality and data. Site administrators should update immediately to a patched version.
What an attacker can do
Run arbitrary PHP code on the site with the privileges of the web server.
Potential impact on your site
An authenticated attacker can compromise your site, steal data, modify content, or install malware.
Conditions required to exploit
Attacker must have a low-privilege user account (e.g., contributor or subscriber) and exploit requires specific conditions.
Key dates
External resources
Related vulnerabilities
