CVE-2024-13408

High

Published: 24 January 2025

Published

24 January 2025

Modified

05 February 2025

KEV Added

—

Patch

—

CVSS Score 7.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS Score 0.0020 42.1th percentile

Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2024-13408 is a high-severity PHP Remote File Inclusion (CWE-98) vulnerability in Pickplugins Post Grid. Its CVSS base score is 7.5 (High).

Operationally, ranked at the 42.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Threat & Defense at a Glance

What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

SI-10 Information Input Validation good match

prevent

Directly addresses the root cause by requiring validation of the 'theme' attribute in the pgcu shortcode to prevent path traversal and local file inclusion.

SI-2 Flaw Remediation good match

prevent

Mandates timely flaw remediation, such as patching the plugin to version 1.7 which fixes the insufficient input validation in shortcode.php.

AC-3 Access Enforcement partial match

prevent

Enforces logical access controls to restrict inclusion and execution of arbitrary files via authenticated shortcode usage by low-privilege users.

NVD Description

The Post Grid, Slider & Carousel Ultimate – with Shortcode, Gutenberg Block & Elementor Widget plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.6.10 via the 'theme' attribute of the `pgcu` shortcode.…

This makes it possible for authenticated attackers, with Contributor-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where php files can be uploaded and included.

Deeper analysisAI

CVE-2024-13408 is a Local File Inclusion (LFI) vulnerability (CWE-98) in the Post Grid, Slider & Carousel Ultimate – with Shortcode, Gutenberg Block & Elementor Widget plugin for WordPress. It affects all versions up to and including 1.6.10 and stems from insufficient validation of the 'theme' attribute in the `pgcu` shortcode, with a CVSS v3.1 base score of 7.5 (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).

Authenticated attackers with Contributor-level access or higher can exploit this vulnerability over the network by crafting a malicious shortcode that includes arbitrary files on the server. Successful exploitation allows execution of PHP code within those files, enabling attackers to bypass access controls, obtain sensitive data, or achieve remote code execution in scenarios where PHP files can be uploaded and subsequently included.

The WordPress plugin repository provides a patch in version 1.7, visible in changeset 3227281 to the shortcode.php file. Additional threat intelligence and details are available from Wordfence at their vulnerability page.