Local File Inclusion Vulnerability in Traveler Theme for WordPress

CVE-2024-12811

What is CVE-2024-12811?

The Traveler theme for WordPress is susceptible to a Local File Inclusion vulnerability through the 'hotel_alone_slider' shortcode 'style' attribute, allowing authenticated users with contributor-level permissions and higher to include and execute arbitrary files on the server. This flaw enables attackers to bypass access controls, obtain sensitive data, or execute malicious PHP code by leveraging included files. All versions of the Traveler theme up to 3.1.8 are affected, making it crucial for site administrators to apply the latest updates and implement security measures to protect against potential exploitation.

References