CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
What the vulnerability does
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in devnex Devnex Addons For Elementor devnex-addons-for-elementor allows PHP Local File Inclusion.This issue affects Devnex Addons For Elementor: from n/a through <= 1.0.9.
Explanation of Vulnerability in Simple Terms
Devnex Addons For Elementor versions 1.0.9 and earlier contain a code injection vulnerability. An attacker with low-level site access can inject and execute arbitrary code, potentially compromising the entire site. The vulnerability requires specific conditions to exploit but grants full control over site data and functionality once successful.
What an attacker can do
Run arbitrary code on the site with the privileges of the WordPress user account.
Potential impact on your site
Complete site compromise possible, including data theft, malware injection, and loss of site control.
Conditions required to exploit
Attacker must have a low-privilege account on the site (e.g., subscriber or contributor role).
Key dates
External resources
Related vulnerabilities
