CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
What the vulnerability does
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Lomu WPCOM Member wpcom-member allows PHP Local File Inclusion.This issue affects WPCOM Member: from n/a through <= 1.7.7.
Explanation of Vulnerability in Simple Terms
WPCOM Member versions up to 1.7.7 contain a code injection vulnerability that allows authenticated users to execute arbitrary PHP code on the site. An attacker with low-level account access can run malicious code with full site privileges, compromising the entire WordPress installation. Update to a version newer than 1.7.7 immediately.
What an attacker can do
Run arbitrary PHP code on the site with full administrative privileges.
Potential impact on your site
Complete site compromise: data theft, malware injection, user account takeover, and site defacement are all possible.
Conditions required to exploit
Attacker must have a low-privilege user account (subscriber, contributor, or similar) on the site.
Key dates
External resources
