CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
What the vulnerability does
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Greg Winiarski WPAdverts wpadverts allows PHP Local File Inclusion.This issue affects WPAdverts: from n/a through <= 2.2.2.
Explanation of Vulnerability in Simple Terms
WPAdverts versions up to 2.2.2 contain a code injection vulnerability that allows authenticated attackers to execute arbitrary PHP code on the site. The vulnerability requires low-level user privileges and difficult network conditions to exploit, but successful exploitation grants full control over the site's functionality and data. Update to version 2.3.2 or later to remediate.
What an attacker can do
Run arbitrary PHP code on the site with the privileges of the web server.
Potential impact on your site
Attackers with low-privilege accounts can compromise your entire site, steal data, or inject malware.
Conditions required to exploit
Attacker must have a low-privilege user account (e.g., subscriber or contributor role).
Key dates
External resources
Related vulnerabilities
