Local File Inclusion Vulnerability in Companion Auto Update Plugin by WordPress
CVE-2018-20973

9.8CRITICAL

Key Information:

Vendor
Wordpress
Status
Companion Auto Update
Vendor
CVE Published:
16 August 2019

Summary

The Companion Auto Update Plugin for WordPress, prior to version 3.2.1, is susceptible to a local file inclusion vulnerability. This flaw could allow attackers to exploit the plugin by including unauthorized files, potentially leading to sensitive information disclosure or unauthorized access. Website administrators are advised to update to the latest version to mitigate associated risks.

References

https://wordpress.org/plugins/companion-auto-update/#deve...
x_refsource_MISC

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.