CVE-2024-37520

Deeper analysis

CVE-2024-37520 is a PHP Remote File Inclusion vulnerability (CWE-98) caused by improper control of filenames in include/require statements. It affects the ShopBuilder – Elementor WooCommerce Builder Addons plugin for WordPress in all versions through 2.1.12. The flaw carries a CVSS 3.1 score of 6.5 with network attack vector, low complexity, and low privileges required, resulting in high confidentiality impact without affecting integrity or availability.

An authenticated attacker with low-privileged access can supply a crafted filename to force inclusion of arbitrary local or remote files, enabling unauthorized reading of sensitive data on the server. Exploitation occurs over the network without user interaction and targets the plugin's file-handling logic in the affected WordPress installation.

Advisories published by Patchstack identify the issue as a local file inclusion vulnerability in the same plugin versions and provide the associated CVE details for remediation tracking.

The EPSS score rose materially from a low baseline to a peak of 0.0642 on 2026-04-02 before receding to the current value of 0.0127, indicating a period of increased exploitation interest after public disclosure.