Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
8.8

Stars Testimonials plugin for WordPress: Attacker can run malicious code

CVE-2024-11429 · published 1 year ago
Summary

An attacker with contributor-level access to a WordPress site using the Stars Testimonials plugin can run any PHP code on the server, potentially accessing sensitive data or executing malicious actions. This affects all versions up to 3.3.3. Update the plugin to a version after 3.3.3 to fix the issue.

Original advisory text
The Free Responsive Testimonials, Social Proof Reviews, and Customer Reviews – Stars Testimonials plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3....
The Free Responsive Testimonials, Social Proof Reviews, and Customer Reviews – Stars Testimonials plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.3.3 via the 'stars-testimonials-with-slider-and-masonry-grid' shortcode. This makes it possible for authenticated attackers, with contributor-level access and above, to include and execute arbitrary PHP files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where PHP files can be uploaded and included.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker full control
Severity
8.8 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-98Improper Control of Filename for Include
Timeline
Published5 Dec 2024
Updated4 Nov 2026
First seen7 Mar 2026
Sources
CVE-2024-11429 · NVD
Track software like this
Free during beta