Unauthorized File Inclusion Vulnerability in Shariff Wrapper Plugin for WordPress

CVE-2024-4098

What is CVE-2024-4098?

The Shariff Wrapper plugin for WordPress is vulnerable to a Local File Inclusion (LFI) issue in versions up to and including 4.6.13 due to a flaw in the shariff3uu_fetch_sharecounts function. This vulnerability allows unauthenticated attackers to include and execute arbitrary files on the server. Exploiting this flaw could lead to the execution of any PHP code contained within those files, enabling attackers to bypass existing access controls, access sensitive data, or execute malicious scripts when 'safe' file types, such as images, are uploaded and included. It's crucial for users of the Shariff Wrapper plugin to upgrade to the latest secure version to mitigate these risks.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References