CVE-2024-5574: 
WordPress vulnerability analysis and mitigation

The WP Magazine Modules Lite plugin for WordPress contains a Local File Inclusion vulnerability (CVE-2024-5574) affecting all versions up to and including 1.1.2. The vulnerability was discovered and reported by Wordfence, with public disclosure on June 19, 2024 (NVD CVE).

The vulnerability exists in the 'blockLayout' parameter of the plugin, which can be exploited to include and execute arbitrary files on the server. The issue has been assigned a CVSS v3.1 base score of 7.5 (High) with the vector string CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating network accessibility with high attack complexity and requiring low privileges (Wordfence Intel).

The vulnerability allows authenticated attackers with Contributor-level access or higher to include and execute arbitrary files on the server. This can lead to the execution of any PHP code within those files, potentially resulting in unauthorized access to sensitive data, bypass of access controls, and code execution when attackers can upload and include seemingly safe file types like images (NVD CVE).

The vulnerability has been patched, and users should update to a version newer than 1.1.2 of the WP Magazine Modules Lite plugin (WordPress Plugin).