Security readout for executives and security teams
Plain-English summary
A WordPress plugin called "Notifications for Forms & WordPress Actions" (WANotifier) before version 2.6 has a flaw that lets any logged-in user, even a low-privilege subscriber, trick the site into loading and running arbitrary PHP files already present on the server. That can lead to full site takeover on sites that allow open registration.
Executive priority
Treat as a high-priority patch this cycle for any WordPress property using this plugin, particularly customer-facing sites with open registration. Business risk is site defacement, data exposure, or full compromise from a low-cost subscriber account, though no active exploitation is confirmed in the cited sources.
Technical view
The plugin builds a server-side include path from a user-supplied value without validation, producing a Local File Inclusion (CWE-22) reachable by authenticated subscriber+ accounts. Exploitation causes the PHP interpreter to load and execute attacker-chosen local files. Vendor fixed the input handling in version 2.6, per the WPScan advisory referenced by NVD/CVE.
Likely exposure
WordPress sites running the WANotifier plugin at versions below 2.6, especially those permitting self-service subscriber registration or having many low-tier accounts. Sites that block open registration and tightly control subscribers face materially lower exposure but remain at risk from any compromised low-privilege account.
Exploitation context
CVSS 3.1 base 7.5 (AV:N/AC:H/PR:L/UI:N/C:H/I:H/A:H); requires authenticated subscriber-level access. Not listed in CISA KEV, and no public in-the-wild exploitation is cited in the source bundle. WPScan classifies the entry with an "exploit" tag, indicating a documented proof of concept exists in the referenced advisory.
Researcher notes
CWE-22 path traversal manifesting as PHP LFI; impact depends on files reachable within the include path and PHP configuration. Sources do not name the vulnerable parameter or endpoint publicly, so validate against the WPScan advisory. No KEV entry and no CISA advisory cited; treat exploit availability as "PoC likely" per WPScan tagging rather than confirmed mass exploitation.
Mitigation direction
- Upgrade the Notifications for Forms & WordPress Actions plugin to version 2.6 or later on every site.
- Disable open user registration or restrict the Subscriber role until the plugin is updated.
- Audit and remove unexpected subscriber accounts and rotate credentials on high-value sites.
- Confirm PHP allow_url_include is disabled and enforce open_basedir where feasible.
- If upgrade is blocked, deactivate the plugin and consult vendor guidance for interim mitigations.
Validation and detection
- Inventory WordPress sites and identify the installed WANotifier plugin version via wp-admin or wp-cli.
- Confirm patched sites report version 2.6 or higher after update and clear caches.
- Review web and PHP logs for unusual include paths or errors referencing plugin endpoints.
- Check user tables for recently created subscriber accounts and unexpected role changes.
- Re-run authenticated vulnerability scans (for example WPScan) to confirm the finding clears.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-22: File access and web shell behavior lookup
File traversal and upload weaknesses can lead teams to review file, web shell, execution, and collection telemetry. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2024-6228 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H1.65.9CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
7.5HighVector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://wpscan.com/vulnerability/6382bfea-6265-4f4b-b26e-4219d9ed78aa/CVE reference, WPScan · exploit, vdb-entry
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.