CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
What the vulnerability does
The Eleganzo theme for WordPress is vulnerable to arbitrary directory deletion due to insufficient path validation in the akd_required_plugin_callback function in all versions up to, and including, 1.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary directories on the server, including the WordPress root directory.
Explanation of Vulnerability in Simple Terms
Eleganzo versions 1.2 and earlier contain a path traversal vulnerability that allows authenticated users to read or modify files outside the intended directory. An attacker with low-level access can craft requests to access sensitive files on the server. This vulnerability requires valid user credentials but no additional user interaction.
What an attacker can do
Read or modify files outside the intended application directory on the server.
Potential impact on your site
Sensitive files (config, database backups, private data) may be exposed or altered by authenticated users.
Conditions required to exploit
Attacker must have a valid user account with low-level privileges on the site.
Key dates
External resources
Related vulnerabilities
