How severe is CVE-2024-4098?

This vulnerability has a severity rating of CRITICAL with a CVSS score of 9.8 out of 10.

What type of vulnerability is CVE-2024-4098?

This is classified as CWE-552, which is a common weakness in software security.

CVE-2024-4098 - CRITICAL Severity | CVSS 9.8

Vulnerability Description

The Shariff Wrapper plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 4.6.13 via the shariff3uu_fetch_sharecounts function. This allows unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.

Related Vulnerabilities

CVE-2017-10930

CRITICAL

CVSS:9.8(Critical)

The ZXR10 1800-2S before v3.00.40 incorrectly restricts access to a resource from an unauthorized actor, resulting in ordinary users being able to download configuration files to steal information lik...

CWE-5522017

CVE-2017-14942

CRITICAL

CVSS:9.8(Critical)

Intelbras WRN 150 devices allow remote attackers to read the configuration file, and consequently bypass authentication, via a direct request for cgi-bin/DownloadCfg/RouterCfm.cfg containing an admin:...

CWE-5522017

CVE-2020-12743

CRITICAL

CVSS:9.8(Critical)

An issue was discovered in Gazie 7.32. A successful installation does not remove or block (or in any other way prevent use of) its own file /setup/install/setup.php, meaning that anyone can request it...

CWE-5522020

CVE-2023-29931

CRITICAL

CVSS:9.8(Critical)

laravel-s 3.7.35 is vulnerable to Local File Inclusion via /src/Illuminate/Laravel.php.

CWE-5522023

CVE-2023-48710

CRITICAL

CVSS:9.8(Critical)

iTop is an IT service management platform. Files from the `env-production` folder can be retrieved even though they should have restricted access. Hopefully, there is no sensitive files stored in that...

CWE-5522023

CVE-2023-50164

CRITICAL

CVSS:9.8(Critical)

An attacker can manipulate file upload params to enable paths traversal and under some circumstances this can lead to uploading a malicious file which can be used to perform Remote Code Execution. Use...

CWE-5522023