CVE-2024-52450: 
WordPress vulnerability analysis and mitigation

A Local File Inclusion vulnerability (CVE-2024-52450) was discovered in Official pro coders nBlocks WordPress plugin versions through 1.0.2. The vulnerability is classified as an Improper Control of Filename for Include/Require Statement in PHP Program vulnerability, also known as 'PHP Remote File Inclusion' (Patchstack).

The vulnerability has been assigned a CVSS v3.1 base score of 7.5 (HIGH) with the following vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. The technical classification of this vulnerability falls under CWE-98, which refers to Improper Control of Filename for Include/Require Statement in PHP Program (NVD).

This vulnerability could allow a malicious actor to include local files of the target website and show its output onto the screen. Files which store credentials, such as database credentials, could potentially allow complete database takeover depending on the configuration (Patchstack).

As there is no official fix available and the software appears to be abandoned (last updated over a year ago), it is strongly recommended to remove and replace the nBlocks plugin with an alternative solution (Patchstack).