CVE-2024-10436: WPC Smart Messages for WooCommerce <= 4.2.1 - Authenticated (Subscriber+) Local File Inclusion
The WPC Smart Messages for WooCommerce plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.2.1 via the getconditionvalue function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-10436?
CVE-2024-10436 is classified as a high-severity vulnerability due to the ability for authenticated attackers to exploit it.
How do I fix CVE-2024-10436?
To fix CVE-2024-10436, update the WPC Smart Messages for WooCommerce plugin to version 4.2.2 or higher.
Who is affected by CVE-2024-10436?
CVE-2024-10436 affects users of the WPC Smart Messages for WooCommerce plugin versions 4.2.1 and earlier.
What types of attacks can be performed using CVE-2024-10436?
Authenticated attackers with Subscriber-level access can exploit CVE-2024-10436 to perform Local File Inclusion attacks.
When was CVE-2024-10436 published?
CVE-2024-10436 was published on a date in 2024, highlighting vulnerabilities present in earlier versions.