Verdure Core
Monthly
Local File Inclusion in the Verdure Core WordPress plugin (versions ≤ 1.2) enables unauthenticated remote attackers to include and execute arbitrary PHP files on the server. Rooted in CWE-98 (improper PHP include/require path control), the flaw can be chained with file upload functionality - an attacker uploads a PHP-bearing image or other 'safe' file, then triggers the LFI to execute it - yielding full remote code execution, access control bypass, and sensitive data disclosure. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Local File Inclusion in the Verdure Core WordPress plugin (versions ≤ 1.2) allows unauthenticated remote attackers to include arbitrary files from the server's filesystem by passing unsanitized input to PHP include/require statements. Successful exploitation can expose sensitive server files such as wp-config.php - disclosing database credentials - and, under certain PHP configurations, may enable remote code execution through log poisoning or PHP wrapper abuse. No public exploit code or CISA KEV listing has been identified at time of analysis, though the unauthenticated attack vector lowers the barrier for opportunistic targeting of vulnerable WordPress installations.
Local File Inclusion in the Verdure Core WordPress plugin (versions ≤ 1.2) enables unauthenticated remote attackers to include and execute arbitrary PHP files on the server. Rooted in CWE-98 (improper PHP include/require path control), the flaw can be chained with file upload functionality - an attacker uploads a PHP-bearing image or other 'safe' file, then triggers the LFI to execute it - yielding full remote code execution, access control bypass, and sensitive data disclosure. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Local File Inclusion in the Verdure Core WordPress plugin (versions ≤ 1.2) allows unauthenticated remote attackers to include arbitrary files from the server's filesystem by passing unsanitized input to PHP include/require statements. Successful exploitation can expose sensitive server files such as wp-config.php - disclosing database credentials - and, under certain PHP configurations, may enable remote code execution through log poisoning or PHP wrapper abuse. No public exploit code or CISA KEV listing has been identified at time of analysis, though the unauthenticated attack vector lowers the barrier for opportunistic targeting of vulnerable WordPress installations.