CVE-2024-5709

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

The WPBakery Visual Composer plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 7.7 via the 'layout_name' parameter. This makes it possible for authenticated attackers, with Author-level access and above, and with post permissions granted by an Administrator, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-22

Affected software

No affected versions have been published.

Timeline

Published
Aug 6, 2024
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2024

CVE-2024-570956.8SQL injection vulnerability in Go-CMS v.1.1.10 allows a remote attacker to execute arbitrary code via a crafted payload.CVE-2024-570965.5An issue in wps office before v.19302 allows a local attacker to obtain sensitive information via a crafted file.CVE-2024-570974.8ClassCMS 4.8 is vulnerable to Cross Site Scripting (XSS) in class/admin/channel.php.CVE-2024-570989.8Moss v0.1.3 version has an SQL injection vulnerability that allows attackers to inject carefully designed payloads into the order parameter.CVE-2024-570999.8ClassCMS v4.8 has a code execution vulnerability. Attackers can exploit this vulnerability by constructing a payload in the classview parameCVE-2024-57106.5berriai/litellm version 1.34.34 is vulnerable to improper access control in its team management functionality. This vulnerability allows attCVE-2024-57116.1A stored Cross-Site Scripting (XSS) vulnerability exists in the stitionai/devika chat feature, allowing attackers to inject malicious payloaCVE-2024-57128.1A Cross-Site Request Forgery (CSRF) vulnerability was identified in the stitionai/devika application, affecting the latest version. This vulCVE-2024-57135.4The If-So Dynamic Content Personalization WordPress plugin before 1.8.0.4 does not escape the $_SERVER['REQUEST_URI'] parameter before outpuCVE-2024-57146.8In lunary-ai/lunary version 1.2.4, an improper access control vulnerability allows members with team management permissions to manipulate prCVE-2024-57157.1The wp-eMember WordPress plugin before 10.6.7 does not sanitise and escape a parameter before outputting it back in the page, leading to a RCVE-2024-571516.8SQL Injection vulnerability in rainrocka xinhu v.2.6.5 and before allows a remote attacker to execute arbitrary code via the inputAction.php