CVE-2024-10871: 
WordPress vulnerability analysis and mitigation

The Category Ajax Filter plugin for WordPress contains a Local File Inclusion vulnerability (CVE-2024-10871) affecting all versions up to and including 2.8.2. The vulnerability was discovered by researcher Le Ngoc Anh and was disclosed on November 8, 2024. The issue exists in the 'params[caf-post-layout]' parameter, which can be exploited by unauthenticated attackers (NVD).

The vulnerability is classified with a CVSS v3.1 base score of 9.8 (CRITICAL) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The issue is categorized under CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program). The vulnerability allows for the inclusion and execution of arbitrary files on the server through the manipulation of the 'params[caf-post-layout]' parameter (NVD, Wordfence).

The vulnerability enables attackers to execute arbitrary PHP code contained within included files on the server. This can lead to bypass of access controls, unauthorized access to sensitive data, and potential code execution if files with .php extensions can be uploaded and included (NVD).