Description
The Creta Testimonial Showcase WordPress plugin before 1.2.4 is vulnerable to Local File Inclusion. This makes it possible for authenticated attackers, with editor-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | Creta Testimonial Showcase | < 1.2.4 | 1.2.4 |
References
- https://wpscan.com/vulnerability/27d58c5a-ab87-41aa-a806-53fa96d4351c/ exploit vdb-entry technical-description