CVSS Summary
Score | 6.5 Medium |
---|---|
Vector | Network |
Complexity | Low |
Authentication | Single |
Confidentiality | Partial |
Integrity | Partial |
Availability | Partial |
Last revised:
Users able to edit posts are able to use a shortcode which is vulnerable to local file inclusion. This can allow an attacker read-only access to any non-PHP file, or the ability to execute arbitrary code if they can upload a PHP file.
Current state: Reported
Score | 6.5 Medium |
---|---|
Vector | Network |
Complexity | Low |
Authentication | Single |
Confidentiality | Partial |
Integrity | Partial |
Availability | Partial |
Depending on the exact path to your WordPress installation, the following may or may not cause the contents of /etc/passwd to be displayed (adjust the path as necessary, based on your server configuration):
[theme-my-login login_template="../../../../../../../../../etc/passwd"]
Upgrade to version 6.3.10 or later.
Please note that while the changelog for version 6.3.10 labels this as a potential vulnerability, this plugin is in fact categorically vulnerable as described above. Users of this plugin should not consider version 6.3.10 to be an optional or low-priority upgrade.