Arbitrary File Inclusion Vulnerability in Penci Soledad Data Migrator plugin for WordPress

CVE-2024-3551

What is CVE-2024-3551?

The Penci Soledad Data Migrator plugin for WordPress is affected by a Local File Inclusion vulnerability that stems from the improper handling of the 'data' parameter. This flaw allows unauthenticated attackers to include and execute arbitrary files on the server, creating opportunities for executing any PHP code present in those files. The vulnerability poses serious risks, such as the ability to bypass access controls and potentially access sensitive data. Attackers could exploit this vulnerability through the manipulation of uploads to capture file paths, thus facilitating unauthorized code execution limited to PHP files.

References