CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
What the vulnerability does
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Maidul Dynamic Product Category Grid, Slider for WooCommerce dynamic-product-categories-design allows PHP Local File Inclusion.This issue affects Dynamic Product Category Grid, Slider for WooCommerce: from n/a through <= 1.1.3.
Explanation of Vulnerability in Simple Terms
A low-privilege user can execute arbitrary PHP code on sites running the Dynamic Product Category Grid, Slider for WooCommerce plugin through version 1.1.3. The vulnerability requires network access and low-level authentication but no user interaction. Attackers can read sensitive data, modify site content, or disrupt service. Update to a version newer than 1.1.3 immediately.
What an attacker can do
Execute PHP code on the site, read sensitive data, modify content, or disable the site.
Potential impact on your site
Any low-privilege user account can compromise your entire WooCommerce site and its data.
Conditions required to exploit
Attacker must have low-level user account access (e.g., subscriber or contributor role).
Key dates
External resources
Related vulnerabilities
