7.5

CVE-2023-0159

Exploit

Extensive VC Addons for WPBakery page builder <= 1.9 - Unauthenticated Local File Inclusion

The Extensive VC Addons for WPBakery page builder WordPress plugin before 1.9.1 does not validate a parameter passed to the php extract function when loading templates, allowing an unauthenticated attacker to override the template path to read arbitrary files from the hosts file system. This may be escalated to RCE using PHP filter chains.
Mögliche Gegenmaßnahme
Extensive VC Addons for WPBakery page builder: Update to version 1.9.1, or a newer patched version
Weitere Schwachstelleninformationen
SystemWordPress Plugin
≫
Produkt Extensive VC Addons for WPBakery page builder
Version * - 1.9
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Wprealize ≫ Extensive Vc Addons For Wpbakery Page Builder SwPlatformwordpress Version < 1.9.1
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 91.51% 0.996
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 7.5 3.9 3.6
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N