CVE-2024-53800
Published: 07 January 2025
Summary
CVE-2024-53800 is a high-severity PHP Remote File Inclusion (CWE-98) vulnerability in Rezgo Rezgo Online Booking. Its CVSS base score is 8.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 9.0% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
The vulnerability is a PHP Local File Inclusion issue (CWE-98) stemming from improper control of filenames in include/require statements, present in the Rezgo WordPress plugin for online bookings. It affects all versions through 4.17 and carries a CVSS 3.1 score of 8.1.
An unauthenticated remote attacker can exploit the flaw over the network, albeit with high attack complexity, to include and execute arbitrary local PHP files. Successful exploitation grants full control over confidentiality, integrity, and availability of the affected site without requiring privileges or user interaction.
The Patchstack advisory for the Rezgo plugin documents the issue at version 4.15 and provides a public entry in its vulnerability database for tracking fixes. The associated EPSS score remains low, with a current value of 0.0609 and a peak of only 0.0671.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-52132
Vulnerability details
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in rezgo Rezgo rezgo allows PHP Local File Inclusion.This issue affects Rezgo: from n/a through <= 4.17.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
LFI vulnerability in public-facing WordPress plugin directly enables remote exploitation of the application (T1190).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mitigates CVE-2024-53800 by requiring timely patching of the vulnerable Rezgo WordPress plugin versions through 4.17 to fix the improper filename control in PHP include/require.
Prevents exploitation of the PHP Local File Inclusion by validating filename inputs used in include/require statements against organization-defined allowlists or patterns.
Restricts unauthorized filename inputs to the Rezgo plugin's PHP code, limiting the ability to specify arbitrary local files for inclusion.