HoliThemes Click to Chat Vulnerable to Local File Inclusion

CVE-2024-3849

Summary

The Click to Chat – HoliThemes plugin for WordPress has a security flaw that allows authenticated users with contributor access or higher to exploit Local File Inclusion vulnerabilities. This flaw enables attackers to include and execute arbitrary files stored on the server. Potential outcomes include unauthorized code execution and bypassing of access control measures, which could compromise sensitive information. Given that attackers can manipulate file uploads, even images may serve as vectors for executing harmful PHP code. The vulnerability thus poses a significant risk to users of the affected plugin versions.

References