CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
What the vulnerability does
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in hashthemes Easy Elementor Addons easy-elementor-addons allows PHP Local File Inclusion.This issue affects Easy Elementor Addons: from n/a through <= 2.2.8.
Explanation of Vulnerability in Simple Terms
Easy Elementor Addons versions 2.2.8 and earlier contain a code injection vulnerability. An attacker with low-level site access can inject and execute arbitrary code, gaining full control over the site. The vulnerability requires network access and some technical setup but does not require user interaction. Sites running affected versions should update immediately.
What an attacker can do
Run arbitrary code on the site with full access to data, files, and functionality.
Potential impact on your site
Complete site compromise: data theft, malware injection, defacement, or total loss of control.
Conditions required to exploit
Low-level user account (e.g., contributor or editor role) and network access to the site.
Key dates
External resources
Related vulnerabilities
