CVE-2024-4936

Deeper analysis

The Canto plugin for WordPress is vulnerable to remote file inclusion in all versions through 3.0.8. The flaw exists in the abspath parameter handling within includes/lib/sizes.php and permits an unauthenticated attacker to supply a remote URL that the server will include and execute when the PHP allow_url_include directive is enabled on the target host. The issue carries a CVSS 3.1 score of 9.8.

An unauthenticated network attacker can exploit the vulnerability by sending a crafted request that references a remote file under their control. Successful exploitation results in arbitrary code execution on the web server with the privileges of the web-server process, giving the attacker full control over the affected WordPress site and any data it processes.

Public references from Wordfence and the WordPress plugin Trac indicate that the issue was addressed in a subsequent plugin release; administrators are advised to update to the newest version of the Canto plugin and to ensure allow_url_include remains disabled unless explicitly required.

The EPSS score for this CVE rose from a low baseline to a recorded peak of 0.1598, indicating that exploitation interest increased after public disclosure.