CVE-2024-27971
Published: 17 May 2024
Summary
CVE-2024-27971 is a high-severity PHP Remote File Inclusion (CWE-98) vulnerability. Its CVSS base score is 8.3 (High).
Operationally, ranked in the top 1.4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
CVE-2024-27971 is a PHP Remote File Inclusion vulnerability (CWE-98) affecting the Premmerce Permalink Manager for WooCommerce WordPress plugin. It stems from improper control of filenames in include/require statements and impacts all versions through 2.3.10.
An unauthenticated remote attacker can exploit the flaw via a crafted HTTP request that forces inclusion of arbitrary local or remote files. Successful exploitation, which requires user interaction and carries high attack complexity, can result in arbitrary code execution, full site compromise, or disclosure of sensitive data with changed scope.
The issue is tracked in the Patchstack vulnerability database, which lists the affected plugin versions and links to corresponding advisory entries for remediation guidance. Administrators should apply any available plugin updates that address the file-inclusion logic.
The associated EPSS score stands at 0.6749 with no material rise from a lower baseline.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-25145
Vulnerability details
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Premmerce Premmerce Permalink Manager for WooCommerce woo-permalink-manager.This issue affects Premmerce Permalink Manager for WooCommerce: from n/a through <= 2.3.10.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.