by Kastro
Paper/Archive/CVE-2024-6164

CVE-2024-6164

Unknown Filter & Grids — Filter & Grids < 2.8.33 - Unauthenticated LFI

EPSS 1%public exploitCVSS 9.8
critical.is priorityof 100
53
CVSS 9.8 (ADP, NVD agree)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 65.4.654 × 2013.1Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

The Filter & Grids WordPress plugin before 2.8.33 is vulnerable to Local File Inclusion via the post_layout parameter. This makes it possible for an unauthenticated attacker to include and execute PHP files on the server, allowing the execution of any PHP code in those files.

Affected

ProductAffectedFixed inSource
Filter & Grids< 2.8.332.8.33CNA
filter_\&_grids< 2.8.332.8.33CISA-ADP

Scores by source

CISA ADP9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total

References

exploitwpscan.com/vulnerability/40bd880e-67a1-4180-b197-8dcadaa0ace4