CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
What the vulnerability does
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in WP Shuffle Subscribe to Download Lite subscribe-to-download-lite allows PHP Local File Inclusion.This issue affects Subscribe to Download Lite: from n/a through <= 1.2.9.
Explanation of Vulnerability in Simple Terms
Subscribe to Download Lite versions 1.2.9 and earlier contain a code injection vulnerability. An attacker with low-level site access can inject and execute arbitrary PHP code, gaining full control over the site. The vulnerability requires network access and some technical setup but does not require user interaction. Sites running affected versions should update immediately.
What an attacker can do
Run arbitrary PHP code on the site with full privileges, including reading/modifying data and creating admin accounts.
Potential impact on your site
Complete site compromise: attacker can steal data, modify content, create backdoors, or take the site offline.
Conditions required to exploit
Attacker needs low-level authenticated access to the site (e.g., subscriber or contributor account).
Key dates
External resources
Related vulnerabilities
