Local File Inclusion Vulnerability in MinimogWP eCommerce Theme for WordPress
CVE-2024-13790
9.8CRITICAL
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 19 March 2025
What is CVE-2024-13790?
The MinimogWP theme, a popular eCommerce solution for WordPress, is susceptible to a Local File Inclusion flaw that affects all versions up to and including 3.7.0. This vulnerability arises from improper handling of the 'template' parameter, enabling unauthenticated attackers to include and execute arbitrary files on the server. As a result, potential threats include the execution of PHP code contained within these files, which may lead to bypassing of access controls, exposure of sensitive information, or even full code execution by leveraging seemingly harmless file uploads such as images.
Affected Version(s)
MinimogWP – The High Converting eCommerce WordPress Theme * <= 3.7.0