Local File Inclusion in WP Directory Kit Plugin by WordPress

CVE-2023-2278

What is CVE-2023-2278?

The WP Directory Kit plugin for WordPress is prone to a Local File Inclusion vulnerability through the 'wdk_public_action' function. Attackers can exploit this flaw to include and execute arbitrary files on the server without authentication. This opens pathways for bypassing access controls, obtaining sensitive information, and executing PHP code from included files. Additionally, this vulnerability can be exploited via the upload of seemingly benign file types, further increasing the risk of unauthorized access to critical data and server environment.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References