WP OnlineSupport Hero Banner Ultimate Local File Inclusion Vulnerability

A local file inclusion vulnerability has been identified in the WP OnlineSupport Hero Banner Ultimate plugin, affecting versions through 1.4.4. This vulnerability arises from improper control of filename parameters in PHP include or require statements, allowing potentially malicious actors to include and execute local files on the server.

Impact

Exploitation of this vulnerability could lead to unauthorized access to local files on the server, with the possibility of executing scripts that could compromise the website or server environment. In some cases, this could allow a complete takeover of the database, depending on the file included and the server's configuration.