CVE-2018-7422 Site Editor <= 1.1.1 - Local File Inclusion
HighCVSS 7.5
EPSS 62.3%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
A Local File Inclusion vulnerability in the Site Editor plugin through 1.1.1 for WordPress allows remote attackers to retrieve arbitrary files via the ajax_path parameter to editor/extensions/pagebuilder/includes/ajax_shortcode_pattern.php, aka absolute path traversal.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| siteeditor site editor | <= 1.1.1 | No fix listed |
| wordpress site-editor(WordPress) | <= 1.1.1 | No fix listed |
References
- seclists.org exploit mailing-list third-party-advisory
- wpvulndb.com third-party-advisory
- 44340 exploit third-party-advisory vdb-entry
- Wordfence Intelligence third-party-advisory
- www.cve.org