CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
What the vulnerability does
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in wpshuffle Subscribe To Unlock subscribe-to-unlock allows PHP Local File Inclusion.This issue affects Subscribe To Unlock: from n/a through <= 1.1.5.
Explanation of Vulnerability in Simple Terms
Subscribe To Unlock versions 1.1.5 and earlier contain a code injection vulnerability. An attacker with low-level user privileges can inject and execute arbitrary code on the site without user interaction. This grants full control over the WordPress installation, including access to sensitive data and the ability to modify or delete content.
What an attacker can do
Run arbitrary code on the site and access all data, including user credentials and private content.
Potential impact on your site
Any low-privilege user account can compromise the entire site. Immediate patching required to prevent data theft and site takeover.
Conditions required to exploit
Attacker must have a low-privilege user account (subscriber or contributor level) on the WordPress site.
Key dates
External resources
Related vulnerabilities
