vulnerability
WordPress Plugin: amministrazione-aperta: CVE-2022-1560: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')
| Severity | CVSS | Published | Added | Modified |
|---|---|---|---|---|
| 4 | (AV:N/AC:M/Au:N/C:P/I:N/A:N) | Mar 23, 2022 | May 15, 2025 | Jun 24, 2025 |
Severity
4
CVSS
(AV:N/AC:M/Au:N/C:P/I:N/A:N)
Published
Mar 23, 2022
Added
May 15, 2025
Modified
Jun 24, 2025
Description
The Amministrazione Aperta WordPress plugin through 3.7.3 does not validate the open parameter before using it in an include statement, leading to a Local File Inclusion issue. The original advisory mentions that unauthenticated users can exploit this, however the affected file generates a fatal error when accessed directly and the affected code is not reached. The issue can be exploited via the dashboard when logged in as an admin, or by making a logged in admin open a malicious link
Solution
amministrazione-aperta-plugin-cve-2022-1560
NEW
Explore Exposure Command
Confidently identify and prioritize exposures from endpoint to cloud with full attack surface visibility and threat-aware risk context.