CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
What the vulnerability does
Improper Control of Generation of Code ('Code Injection') vulnerability in Nelio Software Nelio AB Testing nelio-ab-testing allows Code Injection.This issue affects Nelio AB Testing: from n/a through <= 8.2.7.
Explanation of Vulnerability in Simple Terms
Nelio AB Testing versions up to 8.2.7 contain a code injection vulnerability that allows high-privilege users to execute arbitrary PHP code on the site. An attacker with administrator or equivalent access can inject malicious code through the plugin's input handling. This affects confidentiality, integrity, and availability of the entire WordPress installation.
What an attacker can do
Run arbitrary PHP code on the site with full site privileges.
Potential impact on your site
A compromised admin account can execute code affecting the entire site, including data theft, malware injection, and site takeover.
Conditions required to exploit
Attacker must have high-level admin or equivalent privileges on the WordPress site.
Key dates
External resources
Related vulnerabilities
