CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
What the vulnerability does
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in fuelthemes WerkStatt Plugin werkstatt-plugin allows PHP Local File Inclusion.This issue affects WerkStatt Plugin: from n/a through <= 1.6.6.
Explanation of Vulnerability in Simple Terms
The WerkStatt Plugin for WordPress contains a code injection vulnerability affecting versions up to 1.6.6. An authenticated attacker with low privileges can inject and execute arbitrary code on the site, potentially compromising the entire WordPress installation. The vulnerability requires high attack complexity but grants full control over site data and functionality once exploited.
What an attacker can do
Run arbitrary code on the site and access or modify all data.
Potential impact on your site
Complete site compromise possible; attacker can steal data, modify content, or take control of the WordPress installation.
Conditions required to exploit
Attacker must have a low-privilege WordPress account; no user interaction required.
Key dates
External resources
Related vulnerabilities
