PT-2025-2161 · WordPress · Post Grid

Djaidja Moundjid

+1

·

Published

2025-01-24

·

Updated

2025-02-05

·

CVE-2024-13408

CVSS v3.1

8.8

High

VectorAV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions Post Grid, Slider & Carousel Ultimate – with Shortcode, Gutenberg Block & Elementor Widget plugin for WordPress versions up to, and including, 1.6.10
Description The issue allows authenticated attackers, with Contributor-level access and above, to include and execute arbitrary files on the server through the theme attribute of the pgcu shortcode. This enables the execution of any PHP code in those files, which can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where PHP files can be uploaded and included.
Recommendations For versions up to, and including, 1.6.10, update to a version higher than 1.6.10 to resolve the issue. As a temporary workaround, consider restricting access to the pgcu shortcode or disabling the theme attribute to minimize the risk of exploitation. Restrict access to uploading and including PHP files to prevent code execution.

Fix

Weakness Enumeration

CWE-98

Related Identifiers

CVE-2024-13408

Affected Products

Post Grid