CVE-2024-4258: 
WordPress vulnerability analysis and mitigation

The Video Gallery – YouTube Playlist, Channel Gallery by YotuWP plugin for WordPress contains a Local File Inclusion vulnerability (CVE-2024-4258) affecting all versions up to and including 1.3.13. The vulnerability was discovered and reported by Wordfence, with initial disclosure on June 15, 2024 (Wordfence Advisory).

The vulnerability exists in the settings parameter of the plugin, which allows unauthenticated attackers to include and execute arbitrary files on the server. The severity of this vulnerability is rated as Critical with a CVSS v3.1 base score of 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) (NVD).

The vulnerability allows attackers to execute arbitrary PHP code contained in included files, bypass access controls, and obtain sensitive data. This is particularly dangerous when combined with the ability to upload images and other 'safe' file types that could contain malicious code (Wordfence Advisory).

The vulnerability requires no authentication (unauthenticated attack vector) and has low attack complexity, making it highly exploitable. No user interaction is required for successful exploitation (NVD).

A patch has been identified in the WordPress plugin repository. Users are advised to update to a version newer than 1.3.13 (WordPress Plugin).