ThimPress WP Pipes Local File Inclusion Vulnerability

A local file inclusion vulnerability has been identified in the ThimPress WP Pipes WordPress plugin, affecting versions through 1.4.3. This vulnerability arises from improper control of filenames in include or require statements, allowing PHP remote file inclusion that could be exploited to include local files from the target website.

Impact

Exploitation of this vulnerability could lead to unauthorized inclusion of local files, with the potential to display sensitive information such as database credentials. Depending on the configuration, this could allow a complete takeover of the database.

Remediation

Users are advised to update to a version of the WP Pipes plugin that is later than 1.4.3. For those unable to update immediately, Patchstack offers a virtual patch that can be applied to mitigate this vulnerability.