CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
What the vulnerability does
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in codemstory 워드프레스 결제 심플페이 pgall-for-woocommerce allows PHP Local File Inclusion.This issue affects 워드프레스 결제 심플페이: from n/a through <= 5.2.0.
Explanation of Vulnerability in Simple Terms
A remote code execution vulnerability exists in WordPress Simple Pay versions up to 5.2.0. An authenticated attacker with low privileges can execute arbitrary PHP code on the site by exploiting insufficient input validation. The vulnerability requires network access and high attack complexity but grants full control over site data and operations.
What an attacker can do
Run their own PHP code on the site and read or modify any data.
Potential impact on your site
An attacker with basic WordPress access can compromise your entire site, steal customer data, and modify payment processing.
Conditions required to exploit
Attacker must have a low-privilege WordPress account; no user interaction required.
Key dates
External resources
Related vulnerabilities
