/Vulnerability Library

WordPress Campress Theme <= 1.35 - Unauthenticated Local File Inclusion

CVE-2024-10763
Verified

Description

Campress theme for WordPress up to 1.35 contains a local file inclusion caused by 'campress_woocommerce_get_ajax_products' function, letting unauthenticated attackers include and execute arbitrary PHP files, exploit requires no authentication.

Severity

Critical

CVSS Score

9.8

Exploit Probability

4%

Published Date

May 7, 2026

Template Author

pussycat0x

CVE-2024-10763.yaml
9.8Score

CVSS Metrics

CVSS Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVE ID:
cve-2024-10763
CWE ID:
cwe-98

References

https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-themes/campress/campress-135-unauthenticated-local-file-inclusion

Remediation Steps

Update to the latest version beyond 1.35.