Local File Inclusion in WP Directory Kit Plugin by WordPress

CVE-2023-2278

Summary

The WP Directory Kit plugin for WordPress is prone to a Local File Inclusion vulnerability through the 'wdk_public_action' function. Attackers can exploit this flaw to include and execute arbitrary files on the server without authentication. This opens pathways for bypassing access controls, obtaining sensitive information, and executing PHP code from included files. Additionally, this vulnerability can be exploited via the upload of seemingly benign file types, further increasing the risk of unauthorized access to critical data and server environment.

References