CVE-2024-34551CWE-22

WordPress Stockholm theme <= 9.6 - Unauthenticated Local File Inclusion vulnerability

Critical · published June 4, 2024

CVSS v3.1
9.0
EPSS
1%
Percentile
44.8
In the wild
Unconfirmed
What it is

🚨 A sneaky path traversal vulnerability in Select-Themes Stockholm could let an attacker waltz right into your server and access sensitive files! 🔥 Think of it like a delivery driver who follows an incorrect address and ends up in your living room instead of the porch — this flaw allows attackers to request files outside the safe zone, like sneaking in through an open window! If exploited, this vulnerability could allow attackers to read sensitive files or even execute malicious scripts on your server, potentially compromising your entire application. It’s like handing over the keys to your digital house — absolutely devastating!

Put simply

Think of it like a delivery driver who follows an incorrect address and ends up in your living room instead of the porch — this flaw allows attackers to request files outside the safe zone, like sneaking in through an open window! This Path Traversal vulnerability enables attackers to manipulate file paths, leading to local file inclusion on affected versions of Select-Themes Stockholm, from n/a through 9.6.

What to do

If exploited, this vulnerability could allow attackers to read sensitive files or even execute malicious scripts on your server, potentially compromising your entire application. It’s like handing over the keys to your digital house — absolutely devastating! To fix this, immediately patch your installation to the latest version of Select-Themes Stockholm. Ensure that proper input validation and sanitation are in place to limit file access strictly to allowed directories. Don't delay—this one needs your attention! You've got this! Follow these steps and fortify your defenses in no time. 🛡️

The record
Technical detail
CVSS v3.1
9.0 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00542 · 44.8th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2024-06-04T13:19Z
EPSS history
Timeline
  • 04 JUN 13:19Z
    WordPress Stockholm theme <= 9.6 - Unauthenticated Local File Inclusion vulnerability
    cvelistv5