PT-2024-36584 · WordPress · Where I Was

Jonas Höbenreich · Published 2024-06-14 · Updated 2024-06-17 · CVE-2024-5577

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Where I Was, Where I Will Be plugin for WordPress version <= 1.1.1

Description The issue allows unauthenticated attackers to include and execute arbitrary files hosted on external servers via the WIW HEADER parameter of the "/system/include/include user.php" file. This enables the execution of any PHP code in those files, potentially bypassing access controls, obtaining sensitive data, or achieving code execution. The exploitation requires allow url include to be set to true, which is not commonly enabled.

Recommendations For version <= 1.1.1, update to a version greater than 1.1.1 to resolve the issue. As a temporary workaround, consider disabling the WIW HEADER parameter in the "/system/include/include user.php" file until a patch is available. Additionally, ensure that allow url include is set to false to prevent exploitation.

Fix

Weakness Enumeration

CWE-98

Related Identifiers

CVE-2024-5577

Affected Products

Where I Was

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2024-5577 · Security Note
• https://twitter.com/CveFindCom/status/1801525679491613173 · Twitter Post
• https://plugins.trac.wordpress.org/browser/where-i-was-where-i-will-be/trunk/system/include/include_user.php · Note
• https://twitter.com/CVEnew/status/1801547310796599318 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/68e0f54d-08ec-4e41-ac9b-d72cdde5a724?source=cve · Note