CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
What the vulnerability does
The Task Manager plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 3.0.2 via the callback_get_text_from_url() function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.
Explanation of Vulnerability in Simple Terms
Eoxia Task Manager versions 3.0.2 and earlier contain an information disclosure vulnerability. An authenticated user with low privileges can read sensitive data they should not have access to. The vulnerability requires network access and valid login credentials but no user interaction. No integrity or availability impact.
What an attacker can do
Read sensitive data belonging to other users or the system.
Potential impact on your site
User data privacy breach; authenticated users can access confidential information beyond their role.
Conditions required to exploit
Valid login account with low or standard user privileges.
Key dates
External resources
