CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
What the vulnerability does
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in WP Event Manager WP Event Manager wp-event-manager allows PHP Local File Inclusion.This issue affects WP Event Manager: from n/a through <= 3.1.51.
Explanation of Vulnerability in Simple Terms
WP Event Manager versions up to 3.1.51 contain a code injection vulnerability that allows unauthenticated attackers to run arbitrary PHP code on the site. The vulnerability requires specific conditions to exploit but can lead to complete site compromise. No patch version is currently available; administrators should monitor for updates or consider alternative solutions.
What an attacker can do
Run arbitrary PHP code on the site without authentication.
Potential impact on your site
Complete compromise of the WordPress site, including data theft, malware injection, and loss of control.
Conditions required to exploit
Network access to the site; specific conditions must be met (attack complexity is high).
Key dates
External resources
Related vulnerabilities
