Arbitrary File Inclusion Vulnerability in Salient Shortcodes Plugin

CVE-2024-3810

What is CVE-2024-3810?

The Salient Shortcodes plugin for WordPress is susceptible to a Local File Inclusion flaw affecting all versions up to and including 1.5.3. Affected users with contributor-level permissions can exploit this vulnerability via the 'icon' shortcode's 'image' attribute. This exploitation enables the inclusion and execution of arbitrary files on the server, facilitating unauthorized PHP code execution. The outcome of this vulnerability can result in bypassing access controls, leading to unauthorized access to sensitive data and potential code execution exploits, posing serious security implications for affected systems.

References