CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
What the vulnerability does
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Ibrahim Pricing table addon for elementor pricing-table-addon-for-elementor allows PHP Local File Inclusion.This issue affects Pricing table addon for elementor: from n/a through <= 1.0.0.
Explanation of Vulnerability in Simple Terms
The Pricing Table Addon for Elementor contains a code injection vulnerability affecting versions up to 1.0.0. An authenticated attacker with low privileges can inject and execute arbitrary code on the site, potentially compromising the entire WordPress installation. The vulnerability requires network access but no user interaction. Sites using this addon should update immediately.
What an attacker can do
Run arbitrary code on the site with the privileges of the WordPress user account.
Potential impact on your site
Complete site compromise possible; attacker can modify content, steal data, or install malware.
Conditions required to exploit
Attacker must have a low-privilege WordPress account (e.g., subscriber or contributor role).
Key dates
External resources
Related vulnerabilities
