CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
What the vulnerability does
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Splendour splendour allows PHP Local File Inclusion.This issue affects Splendour: from n/a through <= 1.23.
Explanation of Vulnerability in Simple Terms
Splendour versions 1.23 and earlier contain a remote code execution vulnerability. An attacker on the network can exploit this without authentication or user interaction to gain full control of the affected system. The vulnerability stems from improper input validation that allows execution of arbitrary code. Sites running affected versions should update immediately.
What an attacker can do
Run arbitrary code on the site and take full control of the server.
Potential impact on your site
Complete compromise of the site and server; attacker can steal data, modify content, or use the server for further attacks.
Conditions required to exploit
Network access only; no authentication or user interaction required.
Key dates
External resources
Related vulnerabilities
