CVE-2024-6459
News Element Elementor Blog Magazine < 1.0.6 - Unauthenticated LFI
- State
- Published
- Severity
- 9.8 Critical
- Published
- Aug 17, 2024
- Updated
- Sep 13, 2024
- Reserved
- Jul 2, 2024
Description
The News Element Elementor Blog Magazine WordPress plugin before 1.0.6 is vulnerable to Local File Inclusion via the template parameter. This makes it possible for unauthenticated attacker to include and execute PHP files on the server, allowing the execution of any PHP code in those files.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 9.8 Critical | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | CISA-ADP |
Weaknesses
The record names no weakness.
Affected Products
| Product | Versions |
|---|---|
News Element Elementor Blog MagazineUnknown |
|
References
- https://wpscan.com/vulnerability/330359fa-d085-4923-b5a8-c0e2e5267247/exploitvdb-entrytechnical-description
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.