CVE-2024-3849

The Click to Chat – HoliThemes plugin for WordPress before version 4.0 contains a local file inclusion vulnerability that allows contributors and higher-privileged users to include and execute arbitrary files from the server. An attacker with these permissions can leverage this flaw to run arbitrary PHP code, which enables them to circumvent access restrictions, extract confidential information, or achieve remote code execution when combined with the ability to upload files that appear innocuous. This vulnerability affects all versions up to and including 3.35.

Based on public CVE data (MITRE/NVD).