CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
What the vulnerability does
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in webcodingplace Classic Addons – WPBakery Page Builder classic-addons-wpbakery-page-builder-addons allows PHP Local File Inclusion.This issue affects Classic Addons – WPBakery Page Builder: from n/a through <= 3.0.
Explanation of Vulnerability in Simple Terms
Classic Addons for WPBakery Page Builder versions 3.0 and earlier contain a path traversal vulnerability. An authenticated attacker with low privileges can read, write, or delete files on the server outside the intended directory. The vulnerability requires specific attack conditions but can result in full compromise of site data and functionality.
What an attacker can do
Read, write, or delete files anywhere on the server outside the plugin's intended directory.
Potential impact on your site
An attacker with basic site access can steal sensitive files, inject malicious code, or destroy site data.
Conditions required to exploit
Attacker must have a low-privilege WordPress account (e.g., subscriber or contributor role).
Key dates
External resources
Related vulnerabilities
