CVE-2024-37513

The WPCafe plugin for WordPress through version 2.2.27 contains a local file inclusion vulnerability that allows authenticated users with contributor privileges or higher to load and execute arbitrary files from the server. An attacker could exploit this flaw to run malicious PHP code by uploading seemingly harmless files like images and then including them through the vulnerable functionality, potentially gaining unauthorized access to sensitive information or executing arbitrary commands on the server.

Based on public CVE data (MITRE/NVD).