CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
What the vulnerability does
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Mikado-Themes TopScorer - Sports WordPress Theme topscorer allows PHP Local File Inclusion.This issue affects TopScorer - Sports WordPress Theme: from n/a through <= 1.2.
Explanation of Vulnerability in Simple Terms
TopScorer WordPress theme versions 1.2 and earlier contain a code injection vulnerability that allows unauthenticated attackers to execute arbitrary PHP code on affected sites. The vulnerability requires high attack complexity but grants full control over site data and functionality. Site administrators should update immediately to a patched version.
What an attacker can do
Run arbitrary PHP code on the site, read/modify all data, and take full control of the WordPress installation.
Potential impact on your site
Complete compromise of the WordPress site, including database access, user account takeover, and malware injection.
Conditions required to exploit
Network access to the site; no authentication or user interaction required, but exploitation requires specific technical conditions.
Key dates
External resources
Related vulnerabilities
