Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') (CWE-98)
The Clean Login plugin for WordPress is vulnerable to Local File Inclusion in versions up to and including 1.14.5. The vulnerability is exploitable through the 'template' attribute of the clean-login-register shortcode. This allows authenticated attackers with Contributor-level access or higher to include and execute arbitrary files on the server, potentially leading to the execution of any PHP code within those files.
This vulnerability has a high severity with a CVSS v3.1 base score of 8.8. The potential impacts are severe: 1. Bypass of access controls: Attackers could gain unauthorized access to restricted areas of the WordPress site. 2. Data breach: Sensitive information could be exposed, potentially including user data, configuration files, or other confidential information stored on the server. 3. Code execution: In cases where "safe" file types like images can be uploaded and included, attackers might achieve arbitrary code execution on the server. 4. Site compromise: The vulnerability could lead to full compromise of the WordPress site, allowing attackers to deface the site, inject malicious code, or use the server for further attacks. 5. Lateral movement: If the WordPress installation is on a shared server, the attacker might be able to access other websites or services on the same server. The attack vector is network-based, requires low attack complexity, and only low privileges (Contributor-level access), making it relatively easy to exploit for authenticated users.
There is no evidence that a public proof-of-concept exists. There is no evidence of proof of exploitation at the moment.
A patch is available. The vulnerability has been fixed in version 1.14.6 of the Clean Login plugin. WordPress site administrators should update to this version or later as soon as possible.
1. Update the Clean Login plugin to version 1.14.6 or later immediately. 2. If immediate updating is not possible, consider temporarily disabling the Clean Login plugin until it can be updated. 3. Implement the principle of least privilege: review and restrict user roles and permissions, especially for Contributor-level accounts and above. 4. Enable and configure a Web Application Firewall (WAF) to help detect and block potential exploit attempts. 5. Regularly monitor WordPress and server logs for any suspicious activities, especially those related to file inclusions or unexpected PHP executions. 6. Ensure that file upload functionality is strictly controlled and that uploaded files are properly sanitized and stored in a location that cannot be directly executed by the web server. 7. Keep WordPress core, all themes, and other plugins up-to-date to minimize overall attack surface. 8. Implement regular and secure backups of the WordPress site to enable quick recovery in case of a successful exploit. 9. Consider using a security plugin that can monitor for file changes and unexpected behaviors on your WordPress site.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Feedly found the first article mentioning CVE-2024-8252. See article
Feedly estimated the CVSS score as HIGH
NVD published the first details for CVE-2024-8252
A CVSS base score of 8.8 has been assigned.
EPSS Score was set to: 0.05% (Percentile: 16.3%)
Detection for the vulnerability has been added to Qualys (152180)