Plugin Vulnerable to Local File Inclusion

CVE-2024-12040

What is CVE-2024-12040?

The Product Carousel Slider & Grid Ultimate plugin for WooCommerce is subject to a Local File Inclusion vulnerability that allows users with Contributor-level access or higher to include arbitrary files on the server through the 'theme' attribute in the wcpcsu shortcode. This vulnerability can lead to the execution of PHP code embedded in these files, enabling attackers to circumvent access controls, retrieve sensitive information, and exploit the system further by executing malicious code when non-traditional file types are uploaded.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References