CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
What the vulnerability does
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Bringthepixel Bimber - Viral Magazine WordPress Theme.This issue affects Bimber - Viral Magazine WordPress Theme: from n/a through 9.2.5.
Explanation of Vulnerability in Simple Terms
The Bimber WordPress theme versions up to 9.2.5 contain a remote code execution vulnerability. An authenticated attacker with low privileges can execute arbitrary PHP code on the site without user interaction. This grants full control over the WordPress installation, including access to all data and the ability to modify or delete content.
What an attacker can do
Run their own PHP code on the site and take full control of the WordPress installation.
Potential impact on your site
A compromised site can have all data stolen, modified, or deleted, and malware injected for visitor attacks.
Conditions required to exploit
Attacker must have a low-privilege WordPress user account (e.g., subscriber or contributor role).
Key dates
External resources
Related vulnerabilities
