CVE-2024-0844

CVE-2024-0844 describes a Local File Inclusion vulnerability in version 2.1.6 of the Popup More Popups, Lightboxes, and more popup modules plugin for WordPress, specifically affecting the felixmoira ai_popup product. This flaw allows authenticated attackers with administrator privileges to include and execute arbitrary PHP files ending in "Form.php" on the server. Rated 7.2 HIGH on the CVSS scale, this vulnerability carries significant risk due to its potential for bypassing access controls, exfiltrating sensitive data, and achieving remote code execution. The attack requires high privileges but has low attack complexity, posing a severe threat once an administrator account is compromised. Currently, there is no evidence of active exploitation, nor are there publicly available exploit modules in Metasploit, Nuclei, or ExploitDB. Community discussion and media coverage for this CVE are minimal, indicating a low level of public awareness at this time.