CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
What the vulnerability does
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in HT Plugins HT Contact Form 7 ht-contactform allows PHP Local File Inclusion.This issue affects HT Contact Form 7: from n/a through <= 2.0.0.
Explanation of Vulnerability in Simple Terms
HT Contact Form 7 versions 2.0.0 and earlier contain a vulnerability that allows high-privilege users to read sensitive data, modify site content, or disrupt service. The vulnerability requires network access and high administrative privileges to exploit. Site administrators should update to a version newer than 2.0.0 as soon as a patch becomes available.
What an attacker can do
Read sensitive data, modify site content, or disrupt service availability.
Potential impact on your site
High-privilege user accounts could be compromised to access data, alter forms, or cause downtime.
Conditions required to exploit
Attacker must have high-level administrative privileges on the site.
Key dates
External resources
Related vulnerabilities
