CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
What the vulnerability does
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Kevon Adonis WP Abstracts wp-abstracts-manuscripts-manager allows PHP Local File Inclusion.This issue affects WP Abstracts: from n/a through <= 2.7.4.
Explanation of Vulnerability in Simple Terms
WP Abstracts versions 2.7.4 and earlier contain a code injection vulnerability that allows an attacker to execute arbitrary code on the site. The vulnerability requires user interaction—typically a victim must click a malicious link or visit a crafted page. An attacker with no prior authentication can exploit this to gain full control of the WordPress installation.
What an attacker can do
Execute arbitrary code on the site and take full control of WordPress.
Potential impact on your site
Complete compromise of the WordPress site, including data theft, malware injection, and site defacement.
Conditions required to exploit
Victim must click a malicious link or visit an attacker-controlled page; no authentication required.
Key dates
External resources
Related vulnerabilities
