Description
The PixelYourSite WordPress plugin before 11.1.2 does not validate some URL parameters before using them to generate paths passed to function/s, allowing any admins to perform LFI attacks
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | PixelYourSite | < 11.1.2 | 11.1.2 |
References
- https://wpscan.com/vulnerability/88a99f9d-dc7f-4c04-8734-77295c8656bf/ exploit vdb-entry technical-description