CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
What the vulnerability does
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in unfoldwp Magazine eximious-magazine allows PHP Local File Inclusion.This issue affects Magazine: from n/a through <= 1.2.2.
Explanation of Vulnerability in Simple Terms
Magazine versions 1.2.2 and earlier contain a code injection vulnerability that allows unauthenticated attackers to execute arbitrary code on the site. The vulnerability requires high attack complexity but grants full control over confidentiality, integrity, and availability. Site administrators should update immediately to a version newer than 1.2.2.
What an attacker can do
Execute arbitrary code on the site and gain full control over data and functionality.
Potential impact on your site
Complete compromise of the site, including data theft, malware injection, and service disruption.
Conditions required to exploit
Network access to the site; no authentication or user interaction required, but exploitation requires specific conditions.
Key dates
External resources
Related vulnerabilities
