CVE-2024-56281

CVE-2024-56281 is an Improper Control of Filename for Include/Require Statement in PHP Program vulnerability, described as PHP Remote File Inclusion but enabling PHP Local File Inclusion (CWE-98), in the WordPress plugin pgall-for-woocommerce (developed by codemstory under the Korean name 워드프레스 결제 심플페이). The issue affects all versions from n/a through 5.2.0. It carries a CVSS v3.1 base score of 7.5 (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to network accessibility, high attack complexity, low privileges required, and high impacts on confidentiality, integrity, and availability.

A low-privileged authenticated user (PR:L) can exploit this vulnerability over the network (AV:N) without user interaction (UI:N), though it requires high attack complexity (AC:H). Successful exploitation allows inclusion of arbitrary local PHP files, potentially leading to unauthorized access to sensitive data, modification of files, or remote code execution within the scope of the affected plugin (S:U), resulting in high confidentiality, integrity, and availability impacts.

The Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/pgall-for-woocommerce/vulnerability/wordpress-plugin-5-2-0-local-file-inclusion-vulnerability?_s_id=cve provides details on the vulnerability in version 5.2.0 and recommends updating to a patched version where available or removing the plugin if no fix exists.