Critical · published February 13, 2025
🔥 An unauthenticated attacker can exploit this vulnerability with just a simple call! The Campress theme for WordPress allows arbitrary file inclusion, which is a game-changer for bad actors! ⚡ Imagine your office had a guestbook that anyone could write in, but it also allowed anyone to access sensitive files just by naming them! That’s the kind of oversight we’re dealing with here, where the wrong call can lead straight to sensitive data or even full server control. An attacker could gain unauthorized access to sensitive information, potentially executing harmful PHP code right on your server. This means they could bypass access controls like a pesky intruder slipping through an open door — with the potential to wreak absolute havoc on your data and site integrity!
Imagine your office had a guestbook that anyone could write in, but it also allowed anyone to access sensitive files just by naming them! That’s the kind of oversight we’re dealing with here, where the wrong call can lead straight to sensitive data or even full server control. This Local File Inclusion vulnerability in the Campress theme is triggered by the 'campress_woocommerce_get_ajax_products' function. It allows attackers to include arbitrary files on the server, leading to possible code execution if they can upload PHP files.
An attacker could gain unauthorized access to sensitive information, potentially executing harmful PHP code right on your server. This means they could bypass access controls like a pesky intruder slipping through an open door — with the potential to wreak absolute havoc on your data and site integrity! Immediate action is crucial! Update the Campress theme to version 1.36 or later to patch this vulnerability. Furthermore, consider auditing your server for any unauthorized files that may have been included, and tighten controls over file uploads. You’ve got this! Follow these steps, and soon your WordPress site will be back in tip-top shape! 🛡️