CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
What the vulnerability does
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in fuelthemes Revolution revolution.This issue affects Revolution: from n/a through < 2.5.8.
Explanation of Vulnerability in Simple Terms
Revolution by Fuel Themes contains a code injection vulnerability affecting versions up to 2.5.8. An authenticated attacker with low privileges can inject and execute arbitrary code on the site, potentially compromising the entire installation. The vulnerability requires network access but no user interaction. Site administrators should update immediately to a patched version.
What an attacker can do
Run arbitrary code on the site with the privileges of the web server.
Potential impact on your site
Complete site compromise possible, including data theft, malware injection, and loss of availability.
Conditions required to exploit
Attacker must have a low-privilege user account; network access to the site.
Key dates
External resources
Related vulnerabilities
