PT-2024-35847 · Unknown · Cool Plugins Cryptocurrency Widgets For Elementor

Zaidan Rizaki · Published 2024-11-30 · Updated 2024-12-01 · CVE-2024-53739

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Cool Plugins Cryptocurrency Widgets For Elementor versions 1.6.4 and earlier

Description The issue is related to an Improper Control of Filename for Include/Require Statement in PHP Program, also known as 'PHP Remote File Inclusion', which allows PHP Local File Inclusion. This could potentially lead to remote code execution.

Recommendations For versions 1.6.4 and earlier, update the plugin to a patched version as soon as possible to mitigate the risk of exploitation. As a temporary workaround, consider restricting access to vulnerable PHP files or functions until a patch is available.

Fix

Weakness Enumeration

CWE-706

CWE-98

Related Identifiers

CVE-2024-53739

Affected Products

Cool Plugins Cryptocurrency Widgets For Elementor

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2024-53739 · Security Note
• https://osv.dev/vulnerability/CVE-2024-53739 · Vendor Advisory
• https://patchstack.com/database/wordpress/plugin/cryptocurrency-widgets-for-elementor/vulnerability/wordpress-cryptocurrency-widgets-for-elementor-plugin-1-6-4-local-file-inclusion-vulnerability?_s_id=cve · Note
• https://twitter.com/oktsec/status/1863140394566856932 · Twitter Post
• https://t.me/latest_high_impact_cve/1599 · Telegram Post
• https://twitter.com/CVEnew/status/1862968130697560348 · Twitter Post
• https://t.me/cvedetector/11718 · Telegram Post
• https://patchstack.com/database/Wordpress/Plugin/cryptocurrency-widgets-for-elementor/vulnerability/wordpress-cryptocurrency-widgets-for-elementor-plugin-1-6-4-local-file-inclusion-vulnerability?_s_id=cve · Note
• https://twitter.com/VulmonFeeds/status/1863224086563893538 · Twitter Post
• https://t.me/cvenotify/102752 · Telegram Post