Unauthorized File Inclusion Vulnerability in YouTube Playlist and Channel Gallery Plugin for WordPress

CVE-2024-4258

Summary

The Video Gallery – YouTube Playlist, Channel Gallery plugin by YotuWP for WordPress is susceptible to a Local File Inclusion vulnerability that impacts all versions up to and including 1.3.13. This vulnerability allows unauthenticated attackers to manipulate the settings parameter, enabling them to include and execute arbitrary files housed on the server. As a consequence, this flaw permits the execution of malicious PHP code within those files. The exploitation of this vulnerability can lead to unintended access to sensitive information or facilitate unauthorized code execution, particularly in scenarios where file uploads are not sufficiently restricted to safe file types.

References