CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
What the vulnerability does
The Error Log Viewer by BestWebSoft plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.1.6 via the rrrlgvwr_get_file function. This makes it possible for authenticated attackers, with Administrator-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.
Explanation of Vulnerability in Simple Terms
Error Log Viewer by BestWebSoft versions 1.1.6 and earlier contain a path traversal vulnerability that allows high-privilege users to read arbitrary files from the server. An attacker with admin or equivalent access can bypass directory restrictions and access sensitive files outside the intended log directory, such as configuration files or other protected data.
What an attacker can do
Read arbitrary files on the server outside the intended log directory.
Potential impact on your site
Admins or compromised admin accounts can access sensitive files like database credentials or configuration data.
Conditions required to exploit
Attacker must have high-level privileges (admin or equivalent) on the site.
Key dates
External resources
