Edumall
Monthly
Broken access control in ThemeMove's EduMall WordPress theme (versions through 4.5.1) permits authenticated low-privileged users to invoke restricted functionality without proper authorization checks. An attacker with any valid WordPress account can bypass the intended access control tiers and trigger actions that degrade site availability. No public exploit code or active exploitation has been identified at time of analysis, and the CVSS score of 4.3 reflects a contained, low-severity impact limited to availability.
Local file inclusion in ThemeMove EduMall WordPress theme up to version 4.4.7 allows authenticated attackers to read arbitrary files on the server. Exploitation requires low-privilege access and high attack complexity, with no user interaction needed; CVSS base score is 7.5. No active exploitation reported; EPSS probability is very low at 0.08%.
Broken access control in ThemeMove's EduMall WordPress theme (versions through 4.5.1) permits authenticated low-privileged users to invoke restricted functionality without proper authorization checks. An attacker with any valid WordPress account can bypass the intended access control tiers and trigger actions that degrade site availability. No public exploit code or active exploitation has been identified at time of analysis, and the CVSS score of 4.3 reflects a contained, low-severity impact limited to availability.
Local file inclusion in ThemeMove EduMall WordPress theme up to version 4.4.7 allows authenticated attackers to read arbitrary files on the server. Exploitation requires low-privilege access and high attack complexity, with no user interaction needed; CVSS base score is 7.5. No active exploitation reported; EPSS probability is very low at 0.08%.