Server-Side File Inclusion Vulnerability in Notifications for Forms & WordPress Actions Plugin
CVE-2024-6228
Currently unrated
What is CVE-2024-6228?
The Notifications for Forms & WordPress Actions Plugin for WordPress, prior to version 2.6, is prone to a server-side file inclusion vulnerability. This flaw occurs due to the lack of validation on user-supplied input when constructing file paths. As a consequence, authenticated users with subscriber-level or higher privileges can exploit this weakness to include and execute arbitrary PHP files from the server. This creates a significant security risk, allowing unauthorized actions and potential data breaches.
Affected Version(s)
Notifications for Forms & WordPress Actions 0 < 2.6
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.