CVE-2024-48029
Published: 16 October 2024
Summary
CVE-2024-48029 is a high-severity PHP Remote File Inclusion (CWE-98) vulnerability. Its CVSS base score is 7.5 (High).
Operationally, ranked in the top 11.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
CVE-2024-48029 is a PHP Local File Inclusion vulnerability (CWE-98) affecting the SB Random Posts Widget WordPress plugin by Hung Trang Si. The flaw stems from improper control of filenames in include/require statements and impacts all versions through 1.0.
An attacker with low-privileged network access can exploit the issue, although the attack requires high complexity. Successful exploitation grants the ability to include arbitrary local PHP files, resulting in high impact to confidentiality, integrity, and availability on the affected site.
The vulnerability is tracked in the Patchstack database, which identifies the affected plugin versions and provides the associated advisory entry. The EPSS score remains low, with a peak of 0.0550 that has since receded to 0.0403.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-42901
Vulnerability details
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Hung Trang Si SB Random Posts Widget sb-random-posts-widget allows PHP Local File Inclusion.This issue affects SB Random Posts Widget: from n/a through <= 1.0.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.