Campress <= 1.35 - Inclusion Locale de Fichier Non Authentifiée

The impact of this LFI vulnerability is severe. An attacker can leverage it to execute arbitrary PHP code on the web server. This could involve uploading a malicious PHP file, including it via the vulnerable campresswoocommercegetajaxproducts function, and then executing the code. Successful exploitation allows attackers to bypass access controls, steal sensitive data (database credentials, API keys, user information), and potentially gain full control of the WordPress instance. The ability to execute arbitrary code opens the door to a wide range of attacks, including defacement, malware injection, and persistent backdoors. This vulnerability shares similarities with other LFI exploits where attackers leverage file inclusion to gain code execution, highlighting the importance of secure coding practices and input validation.

WordPress websites using the Campress theme, particularly those with default or weak security configurations, are at significant risk. Shared hosting environments where multiple WordPress instances share the same server are especially vulnerable, as a compromise of one site could potentially lead to the compromise of others. Sites that have not implemented robust file access controls are also at increased risk.

• wordpress / composer / npm:

grep -r 'campress_woocommerce_get_ajax_products' /var/www/html/wp-content/themes/campress/

• generic web:

curl -I https://your-wordpress-site.com/wp-content/themes/campress/ | grep -i 'campress_woocommerce_get_ajax_products'

• wordpress / composer / npm:

wp plugin list | grep campress

1. 2025-02-13Disclosure

   disclosure

1. Réservé2024-11-04
2. Publiée2025-02-13
3. EPSS mis à jour2026-04-02

The primary mitigation for CVE-2024-10763 is to upgrade the Campress WordPress theme to a patched version as soon as it becomes available. Until a patch is released, consider temporarily disabling the Campress theme to prevent exploitation. As a temporary workaround, implement strict file access controls on the WordPress server to limit the attacker's ability to include arbitrary files. Review and harden WordPress security configurations, including restricting file upload permissions and implementing a Web Application Firewall (WAF) with rules to block suspicious file inclusion attempts. Monitor WordPress logs for unusual file access patterns or PHP execution errors.