CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
What the vulnerability does
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in NooTheme Jobmonster Elementor Addon jobmonster-addon allows PHP Local File Inclusion.This issue affects Jobmonster Elementor Addon: from n/a through <= 1.1.4.
Explanation of Vulnerability in Simple Terms
The Jobmonster Elementor Addon for WordPress contains a code injection vulnerability affecting versions up to 1.1.4. An authenticated attacker with low privileges can inject and execute arbitrary code on the site, potentially compromising the entire WordPress installation. The vulnerability requires high attack complexity but grants full control over site data and functionality.
What an attacker can do
Run arbitrary code on the WordPress site, read/modify all data, and take full control of the installation.
Potential impact on your site
Any user with low-level WordPress access can compromise your entire site, steal data, and inject malware.
Conditions required to exploit
Attacker must have a low-privilege WordPress user account (e.g., subscriber or contributor role).
Key dates
External resources
Related vulnerabilities
