CVE-2024-12563: s2Member Pro <= 250214 - Authenticated (Contributor+) Local File Inclusion to Remote Code Execution via Shortcode
The s2Member Pro plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 250214 via the 'template' attribute. This makes it possible for authenticated attackers, with contributor-level and above permissions, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-12563?
CVE-2024-12563 has a medium severity rating due to the potential for unauthorized access to sensitive files.
How do I fix CVE-2024-12563?
To fix CVE-2024-12563, update the s2Member Pro plugin to a version later than 250214.
Who is affected by CVE-2024-12563?
CVE-2024-12563 affects users of the s2Member Pro plugin for WordPress who have versions up to and including 250214.
What type of vulnerability is CVE-2024-12563?
CVE-2024-12563 is a Local File Inclusion vulnerability.
Who can exploit CVE-2024-12563?
CVE-2024-12563 can be exploited by authenticated attackers with contributor-level and above permissions.