WordPress Plugin Vulnerabilities

WP-Appbox < 4.3.18 - Authenticated Local File Inclusion

Description

The plugin does not validate user input before using it to create a local path then passed to an include_once statement, leading to a Local File Inclusion issue

Proof of Concept

Affects Plugins

Plugin icon
wp-appbox
Fixed in 4.3.18

Classification

Type
LFI
OWASP top 10
A1: Injection
CWE
CWE-22
CVSS
2.7 (low)

Miscellaneous

Original Researcher
WPScanTeam
Verified
Yes
WPVDB ID
b78e4a3b-e432-4968-8b83-125f3bac15cd

Timeline

Publicly Published
2022-01-17 (about 3 years ago)
Added
2022-01-17 (about 3 years ago)
Last Updated
2022-01-17 (about 3 years ago)

Other

Published
Title
Published
2025-07-22
Title
Post and Page Builder by BoldGrid – Visual Drag and Drop Editor < 1.27.9 - Authenticated (Contributor+) Path Traversal
Published
2014-08-24
Title
KenBurner Slider - Unauthenticated Arbitrary File Download
Published
2014-08-01
Title
Download Shortcode - "file" Arbitrary File Disclosure
Published
2024-06-06
Title
Strategery Migrations <= 1.0 - Unauthenticated Arbitrary File Deletion
Published
2015-03-27
Title
Aspose Cloud eBook Generator - File Download