CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
What the vulnerability does
The Verdure Core plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.2. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.
Explanation of Vulnerability in Simple Terms
Verdure Core versions 1.2 and earlier contain a remote file inclusion vulnerability that allows an attacker to include and execute arbitrary PHP files from external sources. The vulnerability requires specific conditions to exploit but can result in complete site compromise, including data theft, site modification, and service disruption. Site administrators should update to a version newer than 1.2 as soon as possible.
What an attacker can do
Include and execute arbitrary PHP files from external servers, potentially running malicious code on the site.
Potential impact on your site
An attacker could steal data, modify site content, disable the site, or take full control of the server.
Conditions required to exploit
Network access to the site; specific attack conditions must be met (high complexity).
Key dates
External resources
Related vulnerabilities
