Arbitrary File Inclusion Vulnerability in Stars Testimonials Plugin

CVE-2024-11429

Summary

The Stars Testimonials plugin for WordPress, developed by Free Responsive Testimonials, contains a Local File Inclusion vulnerability that affects all versions up to and including 3.3.3. Through the use of the 'stars-testimonials-with-slider-and-masonry-grid' shortcode, authenticated users with contributor-level access or higher can exploit this vulnerability. This allows attackers to include and execute arbitrary PHP files on the server, which can lead to unauthorized access to sensitive data and the potential execution of malicious PHP code. The vulnerability poses significant security risks as it enables bypassing access controls and may facilitate further exploitation on compromised systems.

References