CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
What the vulnerability does
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in mojoomla WPGYM allows PHP Local File Inclusion. This issue affects WPGYM: from n/a through 65.0.
Explanation of Vulnerability in Simple Terms
WPGYM for Joomla versions up to 65.0 contain a remote code execution vulnerability. An authenticated attacker with low privileges can exploit a flaw to execute arbitrary PHP code on the server. The vulnerability requires network access and specific conditions to trigger, but successful exploitation grants full control over the site's functionality and data.
What an attacker can do
Run their own PHP code on the site and access or modify any data.
Potential impact on your site
A compromised user account can lead to complete site takeover, data theft, or malware injection.
Conditions required to exploit
Attacker must have a low-privilege Joomla user account; no user interaction required.
Key dates
External resources
Related vulnerabilities
