CVE-2024-3812: 
WordPress vulnerability analysis and mitigation

The Salient Core plugin for WordPress is vulnerable to Local File Inclusion in versions up to and including 2.0.7. The vulnerability was discovered and disclosed on May 18, 2024, and is tracked as CVE-2024-3812. The vulnerability affects the 'nectar_icon' shortcode specifically through its 'icon_linea' attribute (NVD).

The vulnerability exists in the 'nectar_icon' shortcode implementation, specifically in its 'icon_linea' attribute. This Local File Inclusion vulnerability allows authenticated attackers with contributor-level permissions or higher to include and execute arbitrary files on the server. The vulnerability has been assigned a CVSS v3.1 base score of 7.5 (HIGH) with the vector string CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H (Wordfence).

The vulnerability allows authenticated attackers to execute arbitrary PHP code contained in included files, potentially leading to bypass of access controls, unauthorized access to sensitive data, or achieving code execution when PHP files can be uploaded and included. This represents a significant security risk for affected WordPress installations (NVD).

The vulnerability requires an authenticated user with contributor-level permissions or higher to exploit. The attack vector is network-accessible (AV:N) but requires high attack complexity (AC:H) with low privileges (PR:L) and no user interaction (UI:N) (Wordfence).

Users should update their Salient Core plugin to a version newer than 2.0.7 as soon as possible to mitigate this vulnerability (NVD).