CVE-2024-4551: 
WordPress vulnerability analysis and mitigation

The Video Gallery – YouTube Playlist, Channel Gallery by YotuWP plugin for WordPress contains a Local File Inclusion vulnerability (CVE-2024-4551) affecting all versions up to and including 1.3.13. The vulnerability was discovered by researcher Foxyyy and was publicly disclosed on June 14, 2024 (Wordfence).

The vulnerability exists in the display function of the plugin, which allows authenticated users with contributor access or higher to include and execute arbitrary PHP files on the server. The vulnerability has received a CVSS v3.1 base score of 8.8 HIGH (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) from NIST NVD, while Wordfence assigned it a score of 6.4 MEDIUM (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) (NVD).

The vulnerability can be exploited to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other "safe" file types can be uploaded and included. This poses a significant risk to affected WordPress installations as it could lead to unauthorized access to sensitive information and potential server compromise (NVD).

The vulnerability requires authentication with contributor-level access or higher to exploit. Proof-of-concept exploit techniques are publicly available (PayloadsAllTheThings).

A patch has been released to address this vulnerability. Website administrators running affected versions should update to a version newer than 1.3.13 immediately (WordPress).