CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
What the vulnerability does
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeGoods Photography photography allows PHP Local File Inclusion.This issue affects Photography: from n/a through < 7.7.5.
Explanation of Vulnerability in Simple Terms
ThemeGoods Photography contains a code injection vulnerability affecting versions up to 7.7.5. An attacker with network access can inject and execute arbitrary code without authentication, potentially compromising the entire site. The vulnerability requires specific conditions to exploit but grants full control over confidentiality, integrity, and availability. Immediate patching is critical.
What an attacker can do
Run arbitrary code on the site and take full control of it.
Potential impact on your site
Complete site compromise: data theft, malware injection, defacement, and service disruption.
Conditions required to exploit
Network access only; no authentication or user interaction required, though exploitation requires specific conditions.
Key dates
External resources
Related vulnerabilities
