Local File Inclusion Vulnerability in LotsOfLocales Plugin for WordPress
CVE-2024-12571
9.8CRITICAL
Key Information:
- Vendor
Wordpress
- Vendor
- CVE Published:
- 20 December 2024
What is CVE-2024-12571?
The LotsOfLocales plugin for WordPress, specifically version 3.98.9, is impacted by a Local File Inclusion (LFI) vulnerability. This security flaw exists due to improper validation of the 'sl_engine' parameter, allowing unauthenticated attackers to include arbitrary files hosted on the server. Exploiting this vulnerability could lead to the execution of malicious PHP code, thereby bypassing access controls, accessing sensitive data, or even executing arbitrary code through uploaded files disguised as ‘safe’ formats like images.
Affected Version(s)
Store Locator for WordPress with Google Maps – LotsOfLocales 3.98.9