CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
What the vulnerability does
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Dream-Theme The7 Elements dt-the7-core allows PHP Local File Inclusion.This issue affects The7 Elements: from n/a through <= 2.7.11.
Explanation of Vulnerability in Simple Terms
The7 Elements through version 2.7.11 contains a code injection vulnerability that allows authenticated users with low privileges to execute arbitrary code on the site. The vulnerability requires high attack complexity but grants full read, write, and availability impact once exploited. Site administrators should update to a version newer than 2.7.11 immediately.
What an attacker can do
Run their own code on the site with full read and write access to the database and files.
Potential impact on your site
Compromised site with potential data theft, malware injection, or complete takeover by an authenticated attacker.
Conditions required to exploit
Attacker must have a low-privilege authenticated account (e.g., subscriber or contributor role).
Key dates
External resources
