CVE-2024-10516: Swift Performance Lite <= 2.3.7.1 - Unauthenticated Local PHP File Inclusion via 'ajaxify'
The Swift Performance Lite plugin for WordPress is vulnerable to Local PHP File Inclusion in all versions up to, and including, 2.3.7.1 via the 'ajaxify' function. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-10516?
CVE-2024-10516 is considered a high severity vulnerability due to its potential for unauthorized file execution.
How do I fix CVE-2024-10516?
To fix CVE-2024-10516, update the Swift Performance Lite plugin to version 2.3.7.2 or later.
What type of vulnerability is CVE-2024-10516?
CVE-2024-10516 is a Local PHP File Inclusion vulnerability.
Who is affected by CVE-2024-10516?
All users of the Swift Performance Lite plugin for WordPress up to version 2.3.7.1 are affected by CVE-2024-10516.
Can CVE-2024-10516 be exploited remotely?
Yes, CVE-2024-10516 can be exploited remotely by unauthenticated attackers.