Local File Inclusion in Grid Plus Plugin for WordPress

CVE-2023-5250

Summary

The Grid Plus plugin for WordPress contains a Local File Inclusion vulnerability that enables attackers with subscriber-level privileges and above to exploit the plugin through a potentially dangerous shortcode attribute. This vulnerability permits the inclusion and execution of arbitrary PHP files hosted on the server, posing serious risks such as access control bypass and exposure of sensitive data. Attackers may leverage this weakness to execute malicious code if they can upload PHP files with harmful content. The issue is confined to versions up to and including 1.3.2.

References