CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
What the vulnerability does
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Elicus WPMozo Addons Lite for Elementor wpmozo-addons-lite-for-elementor allows PHP Local File Inclusion.This issue affects WPMozo Addons Lite for Elementor: from n/a through <= 1.1.0.
Explanation of Vulnerability in Simple Terms
WPMozo Addons Lite for Elementor versions up to 1.1.0 contain a code injection vulnerability. An authenticated attacker with low privileges can inject and execute arbitrary code on the site, potentially compromising the entire WordPress installation. The vulnerability requires network access and high attack complexity but does not require user interaction.
What an attacker can do
Run arbitrary code on the site with the privileges of the WordPress user account.
Potential impact on your site
Complete site compromise: attacker can modify content, steal data, install malware, or take full control of the WordPress installation.
Conditions required to exploit
Attacker must have a low-privilege WordPress user account (e.g., subscriber or contributor role).
Key dates
External resources
Related vulnerabilities
