CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
What the vulnerability does
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in nK Visual Portfolio, Photo Gallery & Post Grid visual-portfolio allows PHP Local File Inclusion.This issue affects Visual Portfolio, Photo Gallery & Post Grid: from n/a through <= 3.5.1.
Explanation of Vulnerability in Simple Terms
Visual Portfolio contains a code injection vulnerability affecting versions up to 3.5.1. An authenticated user with low privileges can inject and execute arbitrary code on the site by exploiting improper input handling. This grants full control over site content and data. Update to a version newer than 3.5.1 immediately.
What an attacker can do
Run arbitrary code on the site and access or modify all data.
Potential impact on your site
Any low-privilege user account can compromise the entire site, including database access and file modification.
Conditions required to exploit
Attacker must have a low-privilege user account (e.g., subscriber or contributor role).
Key dates
External resources
Related vulnerabilities
