CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
What the vulnerability does
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Themepul TopperPack – Complete Elementor Addons, Theme & CPT Builder topper-pack allows PHP Local File Inclusion.This issue affects TopperPack – Complete Elementor Addons, Theme & CPT Builder: from n/a through <= 1.2.1.
Explanation of Vulnerability in Simple Terms
TopperPack contains a code injection vulnerability affecting versions up to 1.2.1. An attacker can inject and execute arbitrary code by crafting a malicious request, but requires user interaction to trigger the exploit. The vulnerability allows full compromise of site data and functionality. Update to a version newer than 1.2.1 immediately.
What an attacker can do
Inject and execute arbitrary code on the site, compromising data and functionality.
Potential impact on your site
Complete site compromise possible, including data theft, malware injection, and loss of availability.
Conditions required to exploit
Network access; victim must click a malicious link or visit an attacker-controlled page.
Key dates
External resources
Related vulnerabilities
