CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
What the vulnerability does
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in XpeedStudio Bajaar - Highly Customizable WooCommerce WordPress Theme bajaar allows PHP Local File Inclusion.This issue affects Bajaar - Highly Customizable WooCommerce WordPress Theme: from n/a through <= 2.1.0.
Explanation of Vulnerability in Simple Terms
The Bajaar WooCommerce theme for WordPress contains a code injection vulnerability affecting versions up to 2.1.0. An attacker can inject and execute arbitrary code on the site without authentication. The vulnerability requires specific conditions to exploit but can lead to complete site compromise, including data theft and malware installation.
What an attacker can do
Run arbitrary code on the site, steal data, modify content, or install malware.
Potential impact on your site
Complete compromise of the WordPress site, including customer data, payment info, and admin access.
Conditions required to exploit
Network access to the site; specific attack conditions must be met (high complexity).
Key dates
External resources
Related vulnerabilities
