CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
What the vulnerability does
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in axiomthemes FitFlex fitflex allows PHP Local File Inclusion.This issue affects FitFlex: from n/a through <= 1.6.
Explanation of Vulnerability in Simple Terms
FitFlex versions 1.6 and earlier contain a remote code execution vulnerability. An attacker can exploit this flaw over the network without authentication to run arbitrary code on the affected site. The vulnerability requires specific conditions to be met but poses a critical risk to site integrity and data confidentiality.
What an attacker can do
Run their own code on the site without logging in.
Potential impact on your site
Complete compromise of site data, functionality, and user information if exploited.
Conditions required to exploit
Network access to the site; specific attack conditions must be met (high complexity).
Key dates
External resources
