CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
What the vulnerability does
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in WP Shuffle Subscribe to Download Lite subscribe-to-download-lite allows PHP Local File Inclusion.This issue affects Subscribe to Download Lite: from n/a through <= 1.2.9.
Explanation of Vulnerability in Simple Terms
Subscribe to Download Lite versions 1.2.9 and earlier contain a code injection vulnerability. An attacker with low-level privileges can inject and execute arbitrary code on the site, potentially compromising the entire WordPress installation. The vulnerability requires high attack complexity but grants full control over site data and functionality.
What an attacker can do
Run arbitrary code on the site with full access to data, files, and database.
Potential impact on your site
Complete site compromise possible; attacker can steal data, modify content, create admin accounts, or inject malware.
Conditions required to exploit
Attacker must have a low-privilege account (e.g., subscriber or contributor role).
Key dates
External resources
Related vulnerabilities
