CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
What the vulnerability does
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Bastien Ho Accounting for WooCommerce accounting-for-woocommerce allows PHP Local File Inclusion.This issue affects Accounting for WooCommerce: from n/a through <= 1.6.8.
Explanation of Vulnerability in Simple Terms
Accounting for WooCommerce versions 1.6.8 and earlier contain a vulnerability that allows an attacker to read sensitive data, modify site content, or disrupt service. The attack requires network access and user interaction—typically the site owner or administrator must visit a malicious link or page. The vulnerability affects confidentiality, integrity, and availability of the site.
What an attacker can do
Read sensitive data, modify site content, or disrupt service by tricking a user into visiting a malicious page.
Potential impact on your site
An attacker can compromise your site's data, modify accounting records or WooCommerce settings, or cause downtime.
Conditions required to exploit
Network access and user interaction required; no authentication needed. Victim must click a link or visit attacker-controlled page.
Key dates
External resources
Related vulnerabilities
