Post Grid, Slider & Carousel Ultimate Local File Inclusion Vulnerability

A local file inclusion vulnerability has been identified in the Post Grid, Slider & Carousel Ultimate WordPress plugin, in all versions through 1.6.10. The vulnerability arises from the 'theme' attribute of the 'pgcu' shortcode, allowing authenticated attackers with Contributor-level access or higher to include and execute arbitrary files on the server. This exploitation could bypass access controls, access sensitive data, or execute PHP code in cases where PHP files can be uploaded and included.

Impact

Exploitation of this vulnerability could lead to unauthorized file inclusion, allowing execution of arbitrary PHP code on the server. This could be used to bypass access controls, access sensitive information, or execute malicious code, particularly in environments where PHP file uploads are permitted.

Remediation

Users are advised to update the Post Grid, Slider & Carousel Ultimate plugin to version 1.7 or later.