CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
What the vulnerability does
Improper Control of Generation of Code ('Code Injection') vulnerability in ILLID Advanced Woo Labels advanced-woo-labels allows Remote Code Inclusion.This issue affects Advanced Woo Labels: from n/a through <= 2.36.
Explanation of Vulnerability in Simple Terms
Advanced Woo Labels versions 2.36 and earlier contain a code injection vulnerability that allows high-privilege users to execute arbitrary PHP code on the site. An attacker with admin or equivalent access can inject malicious code through the plugin's input handling. This affects confidentiality, integrity, and availability of the site.
What an attacker can do
Run arbitrary PHP code on the site with full site privileges.
Potential impact on your site
A compromised admin account can execute code to steal data, modify content, or disable the site entirely.
Conditions required to exploit
Attacker must have high-level admin or equivalent privileges on the WordPress site.
Key dates
External resources
Related vulnerabilities
