CVE-2024-56281
Published: 07 January 2025
Summary
CVE-2024-56281 is a high-severity PHP Remote File Inclusion (CWE-98) vulnerability. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 12.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2024-56281 is an Improper Control of Filename for Include/Require Statement in PHP Program vulnerability, described as PHP Remote File Inclusion but enabling PHP Local File Inclusion (CWE-98), in the WordPress plugin pgall-for-woocommerce (developed by codemstory under the Korean name 워드프레스 결제 심플페이). The issue affects all versions from n/a through 5.2.0. It carries a CVSS v3.1 base score of 7.5 (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to network accessibility, high attack complexity, low privileges required, and high impacts on confidentiality, integrity, and availability.
A low-privileged authenticated user (PR:L) can exploit this vulnerability over the network (AV:N) without user interaction (UI:N), though it requires high attack complexity (AC:H). Successful exploitation allows inclusion of arbitrary local PHP files, potentially leading to unauthorized access to sensitive data, modification of files, or remote code execution within the scope of the affected plugin (S:U), resulting in high confidentiality, integrity, and availability impacts.
The Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/pgall-for-woocommerce/vulnerability/wordpress-plugin-5-2-0-local-file-inclusion-vulnerability?_s_id=cve provides details on the vulnerability in version 5.2.0 and recommends updating to a patched version where available or removing the plugin if no fix exists.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-53078
Vulnerability details
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in codemstory 워드프레스 결제 심플페이 pgall-for-woocommerce allows PHP Local File Inclusion.This issue affects 워드프레스 결제 심플페이: from n/a through <= 5.2.0.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
LFI vulnerability in public-facing WordPress plugin directly enables exploitation of the web application for RCE/data access.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Timely remediation through patching the vulnerable pgall-for-woocommerce WordPress plugin directly eliminates the PHP Local File Inclusion vulnerability across affected versions.
Enforces validation of filenames used in PHP include/require statements to block arbitrary local file inclusion by low-privileged authenticated attackers.
Establishes secure PHP configuration settings like open_basedir restrictions to limit the scope of local files accessible via the LFI vulnerability.