CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
What the vulnerability does
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Jack Well jack-well allows PHP Local File Inclusion.This issue affects Jack Well: from n/a through <= 1.0.14.
Explanation of Vulnerability in Simple Terms
Jack Well versions up to 1.0.14 contain a remote code execution vulnerability. An attacker can execute arbitrary code on the site without authentication, though exploitation requires specific conditions to be met. This affects confidentiality, integrity, and availability of the site. Update to a version newer than 1.0.14 immediately.
What an attacker can do
Run their own code on the site and take full control of it.
Potential impact on your site
Complete compromise of the site, including data theft, defacement, and malware installation.
Conditions required to exploit
Network access to the site; no authentication or user interaction required, but attack complexity is high.
Key dates
External resources
Related vulnerabilities
