PT-2024-38986 · WordPress · Wordpress Post Grid Layouts With Pagination – Sogrid
Paulmockford
·
Published
2024-10-26
·
Updated
2024-10-28
·
CVE-2024-8392
CVSS v3.1
7.2
High
| Vector | AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions:
WordPress Post Grid Layouts with Pagination – Sogrid plugin versions up to, and including, 1.5.2
Description:
The issue allows authenticated attackers with Administrator-level access and above to include and execute arbitrary files on the server via the
tab parameter. This enables the execution of any PHP code in those files, which can be used to bypass access controls, obtain sensitive data, or achieve code execution, especially in cases where images and other “safe” file types can be uploaded and included. The issue can also be exploited via CSRF techniques.Recommendations:
For versions up to, and including, 1.5.2, consider disabling the
tab parameter functionality until a patch is available to prevent exploitation.
Restrict access to sensitive files and directories to minimize the risk of arbitrary file inclusion and execution.
Avoid using the tab parameter in API endpoints until the issue is resolved.
As a temporary workaround, restrict Administrator-level access and above to trusted users only.Fix
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Wordpress Post Grid Layouts With Pagination – Sogrid