CVE-2024-43328

The EmbedPress plugin for WordPress prior to version 4.0.10 contains a local file inclusion vulnerability accessible through the 'page_type' parameter that does not require authentication. Attackers can exploit this flaw to include and execute arbitrary files on the server, potentially running any PHP code they choose. This vulnerability allows circumvention of access restrictions, theft of confidential information, or arbitrary code execution when safe file types like images are uploaded and subsequently included.

Based on public CVE data (MITRE/NVD).