Plugin Vulnerable to Local File Inclusion

CVE-2024-12040

Summary

The Product Carousel Slider & Grid Ultimate plugin for WooCommerce is subject to a Local File Inclusion vulnerability that allows users with Contributor-level access or higher to include arbitrary files on the server through the 'theme' attribute in the wcpcsu shortcode. This vulnerability can lead to the execution of PHP code embedded in these files, enabling attackers to circumvent access controls, retrieve sensitive information, and exploit the system further by executing malicious code when non-traditional file types are uploaded.

References