CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
What the vulnerability does
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in dzeriho Improved Sale Badges – Free Version improved-sale-badges-free-version allows PHP Local File Inclusion.This issue affects Improved Sale Badges – Free Version: from n/a through <= 1.0.1.
Explanation of Vulnerability in Simple Terms
Improved Sale Badges – Free Version versions 1.0.1 and earlier contain a code injection vulnerability that allows unauthenticated attackers to execute arbitrary code on affected sites. The vulnerability requires high attack complexity but grants full read, write, and system access. No authentication or user interaction is needed to trigger the flaw.
What an attacker can do
Run arbitrary code on the site, read sensitive data, modify content, and disrupt service.
Potential impact on your site
Complete compromise of the WordPress site, including data theft, malware injection, and loss of availability.
Conditions required to exploit
Network access to the site; no authentication required, but exploitation requires specific conditions.
Key dates
External resources
Related vulnerabilities
