cbcvebase.
CVE-2024-10763
published 2025-02-13

CVE-2024-10763: The Campress theme for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.35 via the…

PriorityP272critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EXPLOIT
EPSS
3.53%
87.8th percentile
The Campress theme for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.35 via the 'campress_woocommerce_get_ajax_products' function. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where php file type can be uploaded and included.

Affected

2 ranges
VendorProductVersion rangeFixed in
apusthemecampress<= 1.35—
apuswpcampress<= 1.35—

Detection & IOCsextracted from sources · hover to see the quote

url/wp-admin/admin-ajax.php↗
commandaction=campress_woocommerce_get_ajax_products&layout=php://filter/convert.base64-encode/resource=/var/www/html/wp-config↗
  • →Detect unauthenticated POST requests to /wp-admin/admin-ajax.php with the action parameter set to 'campress_woocommerce_get_ajax_products' and a 'layout' parameter containing PHP stream wrapper payloads (e.g., php://filter). ↗
  • →A successful exploitation response body will contain the base64-encoded string 'ZGVmaW5l' (decoded: 'define'), indicating wp-config.php contents were leaked. ↗
  • →Monitor for POST requests to admin-ajax.php with Content-Type: application/x-www-form-urlencoded containing 'php://filter' in the body, targeting the campress_woocommerce_get_ajax_products AJAX action — no authentication is required. ↗
  • ·The vulnerability affects only sites running the Campress WordPress theme at version 1.35 or below; the LFI is triggered via the 'campress_woocommerce_get_ajax_products' AJAX function which requires no authentication. ↗
  • ·Code execution via LFI is only achievable if an attacker can first upload a PHP file to the server; otherwise the impact is limited to reading arbitrary files. ↗
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.