What is CVE-2024-5577?

CVE-2024-5577 is a critical-severity vulnerability in Mcnardelli Where I Was, Will Be, classified under PHP Remote File Inclusion. CVSS score: 9.8/10. Published 2024-06-14.

How severe is CVE-2024-5577?

Critical severity. CVSS v3 base score is 9.8 out of 10.

Vulnerability in Mcnardelli Where I Was, Will Be

CVE-2024-5577

The Where I Was, Where I Will Be plugin for WordPress is vulnerable to Remote File Inclusion in version <= 1.1.1 via the WIW_HEADER parameter of the /system/include/include_user.php file. This makes it possible for unauthenticated attackers to include and execute arbitrary files hosted on external servers, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution. This requires allow_url_include to be set to true in order to exploit, which is not commonly enabled.

EPSS: 0.009 (56.3th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

Affected products

Mcnardelli Where I Was, Will Be — versions 0

Weakness classification (CWE)

CWE-98 — PHP Remote File Inclusion

References

Frequently asked questions

What is CVE-2024-5577?: CVE-2024-5577 is a critical-severity vulnerability in Mcnardelli Where I Was, Will Be, classified under PHP Remote File Inclusion. CVSS score: 9.8/10. Published 2024-06-14.
How severe is CVE-2024-5577?: Critical severity. CVSS v3 base score is 9.8 out of 10.