CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
What the vulnerability does
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in miniOrange WordPress Social Login and Register miniorange-login-openid allows PHP Local File Inclusion.This issue affects WordPress Social Login and Register: from n/a through <= 7.7.0.
Explanation of Vulnerability in Simple Terms
The miniOrange WordPress Social Login and Register plugin versions 7.7.0 and earlier contain a vulnerability that allows high-privileged users to read sensitive data or modify site content. The vulnerability requires administrator-level access and high attack complexity. Site owners should update to a version newer than 7.7.0 to mitigate the risk.
What an attacker can do
Read sensitive data or modify site content if they have administrator access.
Potential impact on your site
Administrators with malicious intent or compromised admin accounts can access sensitive data or alter site functionality.
Conditions required to exploit
Attacker must have administrator-level privileges on the WordPress site.
Key dates
External resources
