CVE-2023-5250: 
WordPress vulnerability analysis and mitigation

The Grid Plus plugin for WordPress contains a Local File Inclusion vulnerability (CVE-2023-5250) affecting versions up to and including 1.3.2. The vulnerability was discovered and disclosed on October 29, 2023, and allows authenticated users with subscriber-level privileges or higher to exploit a shortcode attribute (NVD, Wordfence).

The vulnerability has been assigned a CVSS v3.1 base score of 8.8 (HIGH) by NVD with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, while Wordfence assessed it with a score of 6.4 (MEDIUM) with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. The vulnerability is limited to .php files and exists in the shortcode attribute implementation (NVD).

When exploited, this vulnerability allows attackers to include and execute arbitrary PHP files on the server, potentially leading to bypass of access controls, exposure of sensitive data, or code execution in cases where PHP files with arbitrary content can be uploaded and included (NVD).

The vulnerability requires an authenticated user with at least subscriber-level privileges to exploit. The attack can be executed through manipulation of shortcode attributes in the Grid Plus plugin (NVD).

Users should update their Grid Plus plugin to a version newer than 1.3.2 to mitigate this vulnerability (NVD).