Unauthorized File Inclusion Vulnerability in Shariff Wrapper Plugin for WordPress

CVE-2024-4098

Summary

The Shariff Wrapper plugin for WordPress is vulnerable to a Local File Inclusion (LFI) issue in versions up to and including 4.6.13 due to a flaw in the shariff3uu_fetch_sharecounts function. This vulnerability allows unauthenticated attackers to include and execute arbitrary files on the server. Exploiting this flaw could lead to the execution of any PHP code contained within those files, enabling attackers to bypass existing access controls, access sensitive data, or execute malicious scripts when 'safe' file types, such as images, are uploaded and included. It's crucial for users of the Shariff Wrapper plugin to upgrade to the latest secure version to mitigate these risks.

References