CVE-2024-13408
Published: 24 January 2025
Description
The Post Grid, Slider & Carousel Ultimate – with Shortcode, Gutenberg Block & Elementor Widget plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.6.10 via the 'theme' attribute of the `pgcu` shortcode. This makes it possible for authenticated attackers, with Contributor-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where php files can be uploaded and included.
Security Summary
CVE-2024-13408 is a Local File Inclusion (LFI) vulnerability (CWE-98) in the Post Grid, Slider & Carousel Ultimate – with Shortcode, Gutenberg Block & Elementor Widget plugin for WordPress. It affects all versions up to and including 1.6.10 and stems from insufficient validation of the 'theme' attribute in the `pgcu` shortcode, with a CVSS v3.1 base score of 7.5 (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).
Authenticated attackers with Contributor-level access or higher can exploit this vulnerability over the network by crafting a malicious shortcode that includes arbitrary files on the server. Successful exploitation allows execution of PHP code within those files, enabling attackers to bypass access controls, obtain sensitive data, or achieve remote code execution in scenarios where PHP files can be uploaded and subsequently included.
The WordPress plugin repository provides a patch in version 1.7, visible in changeset 3227281 to the shortcode.php file. Additional threat intelligence and details are available from Wordfence at their vulnerability page.
Details
- CWE(s)