CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
What the vulnerability does
Improper Control of Generation of Code ('Code Injection') vulnerability in Builderall Builderall Builder for WordPress builderall-cheetah-for-wp allows Code Injection.This issue affects Builderall Builder for WordPress: from n/a through <= 3.0.1.
Explanation of Vulnerability in Simple Terms
The Builderall Builder plugin for WordPress versions 3.0.1 and earlier allows authenticated users with low privileges to inject and execute arbitrary PHP code on the site. The vulnerability stems from insufficient input validation in code processing functions. An attacker with a low-privilege account can run their own code with full site access, including reading the database and modifying content.
What an attacker can do
Run arbitrary PHP code on the site with full administrative capabilities.
Potential impact on your site
Complete site compromise: attacker can steal data, modify content, create admin accounts, or deface the site.
Conditions required to exploit
Attacker needs a low-privilege WordPress user account (subscriber or contributor level).
Key dates
External resources
