CVE-2024-12040

Summary

CVE-2024-12040 is a vulnerability affecting the Product Carousel Slider & Grid Ultimate plugin for WordPress up to version 1.9.10. This issue allows authenticated attackers with Contributor-level access or higher to execute arbitrary PHP code by leveraging a Local File Inclusion vulnerability in the 'wcpcsu' shortcode's 'theme' attribute. By including and executing unintended files, attackers can bypass access controls, obtain sensitive data, or achieve code execution, posing a significant security risk.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.