CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
What the vulnerability does
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Mojoomla WPCHURCH allows PHP Local File Inclusion.This issue affects WPCHURCH: from n/a through 2.7.0.
Explanation of Vulnerability in Simple Terms
WPCHURCH for Joomla versions up to 2.7.0 contain a remote code execution vulnerability. An attacker can execute arbitrary PHP code on the site without authentication, though exploitation requires specific conditions. This affects confidentiality, integrity, and availability of the site. Update to a version newer than 2.7.0 immediately.
What an attacker can do
Run their own PHP code on the site and take full control of it.
Potential impact on your site
Complete compromise of the Joomla site, including data theft, defacement, and malware installation.
Conditions required to exploit
Network access to the site; no authentication or user interaction required, but attack complexity is high.
Key dates
External resources
Related vulnerabilities
