CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
What the vulnerability does
The Advanced Views – Display Posts, Custom Fields, and More plugin for WordPress is vulnerable to Server-Side Template Injection in all versions up to, and including, 3.7.19. This is due to insufficient input sanitization and lack of access control when processing custom Twig templates in the Model panel. This makes it possible for authenticated attackers, with author-level access or higher, to execute arbitrary PHP code and commands on the server.
Explanation of Vulnerability in Simple Terms
The Advanced Views plugin for WordPress contains a vulnerability allowing authenticated users with low privileges to read sensitive data, modify site content, and disrupt service. The flaw affects all versions up to 3.7.19. An attacker with a basic user account can exploit this without additional user interaction. Site administrators should update immediately to a patched version.
What an attacker can do
Read sensitive data, modify content, and disrupt site availability with a low-privilege user account.
Potential impact on your site
Any registered user can access restricted data, alter posts/products, or cause downtime.
Conditions required to exploit
Attacker must have a valid WordPress user account with low-level permissions.
Key dates
External resources
Related vulnerabilities
