CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
What the vulnerability does
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Arraytics Eventin wp-event-solution allows PHP Local File Inclusion.This issue affects Eventin: from n/a through <= 4.0.25.
Explanation of Vulnerability in Simple Terms
Eventin versions up to 4.0.25 contain a remote code execution vulnerability requiring low-level authentication. An attacker with a valid user account can execute arbitrary PHP code on the site by exploiting improper input validation. This affects confidentiality, integrity, and availability of the entire application.
What an attacker can do
Run their own PHP code on the site with full system access.
Potential impact on your site
Compromised sites can have data stolen, modified, or deleted; attackers can install backdoors or malware.
Conditions required to exploit
Attacker must have a valid user account with low-level privileges and network access to the site.
Key dates
External resources
Related vulnerabilities
