CVE-2024-10763: LFI in Campress WordPress Theme

The impact of this LFI vulnerability is severe. An attacker can leverage it to execute arbitrary PHP code on the web server. This could involve uploading a malicious PHP file, including it via the vulnerable campresswoocommercegetajaxproducts function, and then executing the code. Successful exploitation allows attackers to bypass access controls, steal sensitive data (database credentials, API keys, user information), and potentially gain full control of the WordPress instance. The ability to execute arbitrary code opens the door to a wide range of attacks, including defacement, malware injection, and persistent backdoors. This vulnerability shares similarities with other LFI exploits where attackers leverage file inclusion to gain code execution, highlighting the importance of secure coding practices and input validation.

1. Reserved2024-11-04
2. Published2025-02-13
3. EPSS updated2026-04-02

The primary mitigation for CVE-2024-10763 is to upgrade the Campress WordPress theme to a patched version as soon as it becomes available. Until a patch is released, consider temporarily disabling the Campress theme to prevent exploitation. As a temporary workaround, implement strict file access controls on the WordPress server to limit the attacker's ability to include arbitrary files. Review and harden WordPress security configurations, including restricting file upload permissions and implementing a Web Application Firewall (WAF) with rules to block suspicious file inclusion attempts. Monitor WordPress logs for unusual file access patterns or PHP execution errors.