Local File Inclusion in Blog-in-Blog Plugin for WordPress

CVE-2023-2435

What is CVE-2023-2435?

The Blog-in-Blog plugin for WordPress is susceptible to Local File Inclusion vulnerabilities due to its handling of shortcode attributes. Attackers with editor-level access can exploit this flaw to include and execute arbitrary server-side files. This exploitation could lead to unauthorized access, code execution, and data exposure, particularly if malicious files are uploaded under the guise of safe formats. It is crucial for users and administrators to patch their installations to mitigate these security risks.

References