CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
What the vulnerability does
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Healer - Doctor, Clinic & Medical WordPress Theme healer allows PHP Local File Inclusion.This issue affects Healer - Doctor, Clinic & Medical WordPress Theme: from n/a through <= 1.0.0.
Explanation of Vulnerability in Simple Terms
The Healer WordPress theme contains a critical vulnerability allowing unauthenticated attackers to read sensitive data, modify site content, and disrupt service without any user interaction. The flaw affects all versions up to 1.0.0. Site administrators should update immediately to a patched version when available.
What an attacker can do
Read sensitive data, modify or delete site content, and disrupt the site's availability without authentication.
Potential impact on your site
Your site's data, content, and availability are at immediate risk from remote attackers without any barriers to entry.
Conditions required to exploit
Network access only; no authentication, user interaction, or special configuration required.
Key dates
External resources
Related vulnerabilities
