CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
What the vulnerability does
Improper Control of Generation of Code ('Code Injection') vulnerability in WPFactory Product XML Feed Manager for WooCommerce product-xml-feeds-for-woocommerce allows Remote Code Inclusion.This issue affects Product XML Feed Manager for WooCommerce: from n/a through <= 2.9.3.
Explanation of Vulnerability in Simple Terms
Product XML Feed Manager for WooCommerce versions 2.9.3 and earlier contain a code injection vulnerability. An attacker with low-level site access can inject and execute arbitrary PHP code, gaining full control over the site. The vulnerability affects all confidentiality, integrity, and availability of the WordPress installation.
What an attacker can do
Run arbitrary PHP code on the site with full site privileges.
Potential impact on your site
Complete site compromise: data theft, malware installation, site defacement, or shutdown.
Conditions required to exploit
Attacker needs a low-privilege account (e.g., subscriber or contributor role).
Key dates
External resources
