CVE-2024-4098

The vulnerability occurs in the shariff3uu_fetch_sharecounts function, which does not properly validate file paths, leading to a path traversal vulnerability (CWE-22) and unauthorized access to server files (CWE-552). An attacker can specify any file on the server, and the application will load and execute it as PHP code. In a scenario with file upload capability (e.g., images), an attacker can first upload a crafted file containing PHP code, and then force its execution through the Local File Inclusion mechanism.

An unauthenticated attacker can execute arbitrary PHP code on the server, which in practice means complete takeover of the application and server, bypassing access control mechanisms, and stealing sensitive data.

The Shariff Wrapper plugin should be updated to a version higher than 4.6.13. A patch is available in the WordPress repository under changeset 3103137. Until the update is applied, it is recommended to deactivate the plugin.

Shariff Wrapper plugin for WordPress in versions up to and including 4.6.13.