CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
What the vulnerability does
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in gavias Kiamo - Responsive Business Service WordPress Theme allows PHP Local File Inclusion. This issue affects Kiamo - Responsive Business Service WordPress Theme: from n/a through 1.3.3.
Explanation of Vulnerability in Simple Terms
The Kiamo WordPress theme through version 1.3.3 contains a code injection vulnerability that allows unauthenticated attackers to execute arbitrary code on the site. The vulnerability requires high attack complexity but grants full control over confidentiality, integrity, and availability. Site administrators should update immediately to a patched version.
What an attacker can do
Run arbitrary code on the site and take full control of it.
Potential impact on your site
Complete compromise of the WordPress site, including data theft, malware injection, and site defacement.
Conditions required to exploit
Network access only; no authentication or user interaction required, though exploitation requires specific conditions.
Key dates
External resources
