CVE-2024-6330 GEO my WordPress < 4.4.0.2 - Unauthenticated RCE via LFI
Unauthenticated attackers can achieve remote code execution by including arbitrary files via a local file inclusion vulnerability in the GEO my WP plugin.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-6330?
CVE-2024-6330 is a critical path traversal vulnerability in Unknown GEO my WP, published on 19 Aug 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The GEO my WP WordPress plugin before 4.5.0.2 does not prevent unauthenticated attackers from including arbitrary files in PHP's execution context, which leads to Remote Code Execution.
Which versions are affected by CVE-2024-6330?
It affects 1 product.
Products include Geomywp Geo My Wordpress.
How do I fix CVE-2024-6330?
No fix has been published for CVE-2024-6330 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2024-6330 being exploited?
There is no known exploitation of CVE-2024-6330 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in Unknown GEO my WP
Sources
Also known as GHSA-xv4g-g9fh-fqrj.