BizCalendar Web Local File Inclusion Vulnerability for WordPress

A local file inclusion vulnerability has been identified in the BizCalendar Web plugin for WordPress, affecting all versions through 1.1.0.50. The vulnerability arises in the 'bizcalv' shortcode, allowing authenticated attackers with Contributor-level access and above to include and execute arbitrary files on the server. This exploitation can bypass access controls, access sensitive data, or execute PHP code from included files, particularly when 'safe' file types like images can be uploaded and referenced.

Impact

Exploitation of this vulnerability could lead to unauthorized file inclusion, execution of malicious PHP code on the server, and potential bypassing of access controls.

Remediation

No known patch is available. Users are advised to review the vulnerability details and consider uninstalling the affected plugin.