CVE-2024-6228 — WANotifier < 2.6 - Subscriber+ LFI

CVE-2024-6228

WANotifier < 2.6 - Subscriber+ LFI PUBLISHED

Description (CNA)

The Notifications for Forms & WordPress Actions WordPress plugin before 2.6 does not validate a user-supplied value before using it to build a server-side file inclusion path, allowing authenticated users with subscriber-level access and above to include and execute arbitrary local PHP files on the server.

Affected (CNA)

Vendor / product	Versions
Unknown / Notifications for Forms & WordPress Actions	affected 0 before 2.6

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/6382bfea-6265-4f4b-b26e-4219d9ed78aa/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.