The Shariff Wrapper plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 4.6.13 via the shariff3uu_fetch_sharecounts function. This allows unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.
CVSS
No CVSS.
References
Configurations
History
09 May 2025, 15:03
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-552 | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : unknown |
| References | () https://plugins.trac.wordpress.org/changeset/3103137 - Patch | |
| References | () https://www.wordfence.com/threat-intel/vulnerabilities/id/f49fba00-c576-4a1a-8b0b-9ebed3e3d090?source=cve - Third Party Advisory | |
| References | () https://plugins.trac.wordpress.org/browser/shariff/trunk/shariff.php#L410 - Product | |
| CPE | cpe:2.3:a:datenverwurstungszentrale:shariff_wrapper:*:*:*:*:*:wordpress:*:* | |
| First Time |
Datenverwurstungszentrale
Datenverwurstungszentrale shariff Wrapper |
20 Jun 2024, 07:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2024-06-20 07:15
Updated : 2025-05-09 15:03
NVD link : CVE-2024-4098
Mitre link : CVE-2024-4098
JSON object : View
Products Affected
datenverwurstungszentrale
- shariff_wrapper
CWE
CWE-552
Files or Directories Accessible to External Parties