CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
What the vulnerability does
The NinjaScanner – Virus & Malware scan plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'nscan_ajax_quarantine' and 'nscan_quarantine_select' functions in all versions up to, and including, 3.2.5. This makes it possible for authenticated attackers, with Administrator-level access and above, to delete arbitrary files on the server, including files outside the WordPress root directory.
Explanation of Vulnerability in Simple Terms
NinjaScanner versions up to 3.2.5 contain a vulnerability that allows authenticated administrators to read sensitive files, modify site data, or disrupt service. The flaw requires high-level admin access and does not require user interaction. An attacker with admin credentials can exploit this to compromise confidentiality, integrity, and availability of the site.
What an attacker can do
Read sensitive files, modify site data, or cause service disruption with admin-level access.
Potential impact on your site
An admin account compromise could expose sensitive data, allow unauthorized changes, or cause downtime.
Conditions required to exploit
Attacker must have high-level administrator credentials; no user interaction required.
Key dates
External resources
Related vulnerabilities
