Local File Inclusion Vulnerability in Bootstrap Ultimate Theme for WordPress

CVE-2024-13545

Summary

The Bootstrap Ultimate theme for WordPress is subject to a Local File Inclusion vulnerability, affecting all versions up to and including 1.4.9. This flaw enables unauthenticated attackers to exploit the path parameter, which can lead to the inclusion of arbitrary PHP files from the server. By successfully leveraging this vulnerability, an attacker could bypass access controls, gain access to sensitive data, and even execute malicious PHP code. Moreover, if the php://filter wrapper is activated on the server, this vulnerability could facilitate direct Remote Code Execution, further amplifying the threat. Website owners are advised to patch the vulnerability by upgrading to the latest version of the Bootstrap Ultimate theme.

References