CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
What the vulnerability does
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ApusWP Kossy - Minimalist eCommerce WordPress Theme kossy allows PHP Local File Inclusion.This issue affects Kossy - Minimalist eCommerce WordPress Theme: from n/a through <= 1.45.
Explanation of Vulnerability in Simple Terms
The Kossy WordPress theme contains a vulnerability that allows attackers to read sensitive data, modify site content, or disrupt service. No authentication is required, but the attack is difficult to execute and requires specific conditions. All versions up to 1.45 are affected. Site administrators should update immediately when a patch becomes available.
What an attacker can do
Read sensitive data, modify site content, or cause the site to become unavailable.
Potential impact on your site
Your site's data confidentiality, integrity, and availability are at risk without a patch.
Conditions required to exploit
Network access only; no login or user interaction required, but attack complexity is high.
Key dates
External resources
Related vulnerabilities
