CVE-2024-32523: 
WordPress vulnerability analysis and mitigation

The Mailster WordPress plugin contains a Local File Inclusion vulnerability (CVE-2024-32523) affecting versions up to and including 4.0.6. This security flaw allows unauthenticated attackers to include and execute arbitrary files on the server (WPScan, Patchstack).

The vulnerability is classified as an Improper Limitation of a Pathname to a Restricted Directory (Path Traversal) issue, which enables PHP Local File Inclusion. It has been assigned a CVSS v3.1 base score of 8.1 (HIGH) with the vector string CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:L. The vulnerability is tracked as CWE-22 and allows for unauthenticated access (NVD, Patchstack).

The vulnerability could allow attackers to include local files of the target website and display their contents. This could potentially expose sensitive information such as database credentials, depending on the server configuration. In cases where attackers can upload and include "safe" file types, this vulnerability could lead to code execution and bypass of access controls (WPScan).

The vulnerability requires no authentication to exploit, though it has been rated with high attack complexity. No evidence of active exploitation in the wild has been publicly reported (Patchstack).

The vulnerability has been fixed in version 4.0.7 of the Mailster plugin. Users are strongly advised to update to this version or later to remediate the security risk (WPScan).