Canto plugin vulnerable to Remote File Inclusion exploit

CVE-2024-4936

Summary

The Canto plugin for WordPress contains a Remote File Inclusion vulnerability that affects all versions up to and including 3.0.8. This vulnerability arises from inadequate validation of the abspath parameter, enabling unauthenticated attackers to include and execute remote files on the server. The exploit requires that the allow_url_include setting be enabled on the target WordPress site, which could lead to severe security implications, including unauthorized command execution and server compromise.

References