CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
What the vulnerability does
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in RadiusTheme The Post Grid the-post-grid allows PHP Local File Inclusion.This issue affects The Post Grid: from n/a through <= 7.7.17.
Explanation of Vulnerability in Simple Terms
The Post Grid plugin for WordPress contains a code injection vulnerability affecting versions up to 7.7.17. An authenticated attacker with low privileges can inject and execute arbitrary code on the site, potentially compromising the entire WordPress installation. The vulnerability requires network access but no user interaction. Site administrators should update immediately to a patched version.
What an attacker can do
Run arbitrary code on the WordPress site with the privileges of the authenticated user.
Potential impact on your site
An attacker with a low-privilege account can execute code, read/modify data, or take over the site.
Conditions required to exploit
Attacker must have a valid WordPress account with low-level privileges (e.g., subscriber or contributor role).
Key dates
External resources
