Arbitrary PHP File Inclusion Vulnerability in YouTube Playlist and Channel Gallery Plugin for WordPress

CVE-2024-4551

Summary

The YouTube Playlist, Channel Gallery by YotuWP plugin for WordPress contains a Local File Inclusion vulnerability through the display function. This vulnerability affects all versions up to and including 1.3.13, enabling authenticated users with contributor access and above to include and execute arbitrary PHP files on the server. The exploitation of this vulnerability can lead to bypassing access controls and unauthorized execution of PHP code. Attackers could potentially exploit this flaw to retrieve sensitive data or execute malicious scripts by uploading seemingly safe file types such as images. As a result, it poses a significant security risk for WordPress sites utilizing this plugin.

References