CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
What the vulnerability does
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in GhozyLab Popup Builder easy-notify-lite allows PHP Local File Inclusion.This issue affects Popup Builder: from n/a through <= 1.1.35.
Explanation of Vulnerability in Simple Terms
Popup Builder versions up to 1.1.35 contain a code injection vulnerability that allows authenticated users with low privileges to execute arbitrary code on the site. The vulnerability requires network access and high attack complexity, but does not require user interaction. An attacker can read sensitive data, modify site content, or disrupt service availability.
What an attacker can do
Execute arbitrary code on the site, read sensitive data, modify content, or cause service disruption.
Potential impact on your site
A low-privilege user account (subscriber, contributor, or equivalent) can run malicious code with full site access.
Conditions required to exploit
Attacker must have a low-privilege authenticated account; network access required.
Key dates
External resources
Related vulnerabilities
