CVE-2024-6228
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk24th percentile - higher than 24% of all known CVEs
Summary
The Notifications for Forms & WordPress Actions plugin before version 2.6 does not validate a user-supplied value before using it to build a server-side file inclusion path. This allows authenticated users with subscriber-level access and above to include and execute arbitrary local PHP files on the server.
Risk Assessment
An attacker can execute arbitrary local PHP files, potentially leading to server compromise, data theft, or lateral movement within the network.
Recommendation
Immediately update the Notifications for Forms & WordPress Actions plugin to version 2.6 or later, which includes a fix for this vulnerability.
Original NVD description (English source)
The Notifications for Forms & WordPress Actions WordPress plugin before 2.6 does not validate a user-supplied value before using it to build a server-side file inclusion path, allowing authenticated users with subscriber-level access and above to include and execute arbitrary local PHP files on the server.