CVE-2024-4098: 
WordPress vulnerability analysis and mitigation

The Shariff Wrapper plugin for WordPress contains a Local File Inclusion vulnerability (CVE-2024-4098) affecting versions up to and including 4.6.13. The vulnerability was discovered in the shariff3uu_fetch_sharecounts function and was disclosed on June 20, 2024 (NVD).

The vulnerability exists in the shariff3uu_fetch_sharecounts function of the Shariff Wrapper plugin. It allows unauthenticated attackers to include and execute arbitrary files on the server, enabling the execution of any PHP code within those files. The vulnerability has received a CVSS v3.1 base score of 9.8 CRITICAL (Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) (Wordfence).

The vulnerability can be exploited to bypass access controls, obtain sensitive data, or achieve code execution, particularly in cases where images and other "safe" file types can be uploaded and included. The critical severity rating indicates potential for complete system compromise (NVD).

The vulnerability can be exploited by unauthenticated attackers, requiring no user interaction or special privileges. The low attack complexity and network-based attack vector make this vulnerability particularly concerning (Wordfence).

Users should immediately update their Shariff Wrapper plugin to a version newer than 4.6.13. The vulnerability has been addressed in the plugin's source code as evidenced by the changes in the WordPress plugin repository (WordPress Plugin).