CVE-2024-56278

CVE-2024-56278 is an Improper Control of Generation of Code ('Code Injection') vulnerability in the WP Ultimate Exporter plugin (wp-ultimate-exporter) developed by Smackcoders Inc., which allows PHP Remote File Inclusion. The issue affects all versions of the plugin from n/a through 2.9.1 inclusive. It is classified under CWE-94 and carries a CVSS v3.1 base score of 9.1 (Critical).

The vulnerability is exploitable over the network (AV:N) with low attack complexity (AC:L), but requires high privileges (PR:H), such as those of an authenticated administrator, and no user interaction (UI:N). Exploitation results in a scope change (S:C) with high impacts on confidentiality, integrity, and availability (C:H/I:H/A:H), enabling remote code execution via PHP remote file inclusion.

Patchstack has published an advisory on this remote code execution vulnerability specifically in WP Ultimate Exporter version 2.9.1, available at https://patchstack.com/database/Wordpress/Plugin/wp-ultimate-exporter/vulnerability/wordpress-wp-ultimate-exporter-plugin-2-9-1-remote-code-execution-rce-vulnerability?_s_id=cve. Security practitioners should consult this and any vendor guidance for mitigation recommendations.