title: WP Dark Mode < 4.0.8 - Subscriber+ Local File Inclusion
description: The WP Dark Mode WordPress plugin before 4.0.8 does not properly sanitize the style parameter in shortcodes before using it to load a PHP template. This leads to Local File Inclusion on servers where non-existent directories may be traversed, or when chained with another vulnerability allowing arbitrary directory creation.
problem types: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
affected:
{
vendor: Unknown
product: WP Dark Mode
versions:
status: affected, versionType: custom, version: 0, lessThan: 4.0.8
defaultStatus: unaffected
collectionURL: https://wordpress.org/plugins
}