CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
What the vulnerability does
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in DeluxeThemes Private Messages for UserPro userpro-messaging.This issue affects Private Messages for UserPro: from n/a through <= 4.10.0.
Explanation of Vulnerability in Simple Terms
Private Messages for UserPro versions up to 4.10.0 contain a vulnerability that allows an attacker to read, modify, or delete private messages and user data. The attack requires the victim to click a malicious link or visit a crafted page. The vulnerability affects confidentiality, integrity, and availability of user messages and account information.
What an attacker can do
Read, modify, or delete private messages and user data by tricking a site visitor into clicking a link.
Potential impact on your site
User private messages and account data can be compromised without the site owner's knowledge or action.
Conditions required to exploit
Victim must click a malicious link or visit an attacker-controlled page; no authentication required.
Key dates
External resources
Related vulnerabilities
