CVE-2024-13408
Published: 24 January 2025
Summary
CVE-2024-13408 is a high-severity PHP Remote File Inclusion (CWE-98) vulnerability in Pickplugins Post Grid. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 42.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2024-13408 is a Local File Inclusion (LFI) vulnerability (CWE-98) in the Post Grid, Slider & Carousel Ultimate – with Shortcode, Gutenberg Block & Elementor Widget plugin for WordPress. It affects all versions up to and including 1.6.10 and stems from insufficient validation of the 'theme' attribute in the `pgcu` shortcode, with a CVSS v3.1 base score of 7.5 (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).
Authenticated attackers with Contributor-level access or higher can exploit this vulnerability over the network by crafting a malicious shortcode that includes arbitrary files on the server. Successful exploitation allows execution of PHP code within those files, enabling attackers to bypass access controls, obtain sensitive data, or achieve remote code execution in scenarios where PHP files can be uploaded and subsequently included.
The WordPress plugin repository provides a patch in version 1.7, visible in changeset 3227281 to the shortcode.php file. Additional threat intelligence and details are available from Wordfence at their vulnerability page.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-51585
Vulnerability details
The Post Grid, Slider & Carousel Ultimate – with Shortcode, Gutenberg Block & Elementor Widget plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.6.10 via the 'theme' attribute of the `pgcu` shortcode.…
more
This makes it possible for authenticated attackers, with Contributor-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where php files can be uploaded and included.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
LFI in public-facing WordPress plugin directly enables exploitation of the web app (T1190) and inclusion of uploaded PHP web shells for RCE (T1505.003).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly addresses the root cause by requiring validation of the 'theme' attribute in the pgcu shortcode to prevent path traversal and local file inclusion.
Mandates timely flaw remediation, such as patching the plugin to version 1.7 which fixes the insufficient input validation in shortcode.php.
Enforces logical access controls to restrict inclusion and execution of arbitrary files via authenticated shortcode usage by low-privilege users.