CVE-2024-12040

The Product Carousel Slider & Grid Ultimate for WooCommerce plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.9.10 via the 'theme' attribute of the `wcpcsu` shortcode. This makes it possible for authenticated attackers, with Contributor-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.

• CWE-98

• https://plugins.trac.wordpress.org/changeset/3203986/woo-product-carousel-slider-and-grid-ultimate/tags/1.10.0/includes/classes/class-shortcode.php
• https://www.wordfence.com/threat-intel/vulnerabilities/id/1c22de8c-e6e1-4b85-8d9f-619e9f63129e?source=cve

Published

Dec 12, 2024

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-12035The CS Framework plugin for WordPress is vulnerable to arbit…8.8
• CVE-2024-12036The CS Framework plugin for WordPress is vulnerable to Arbit…7.5
• CVE-2024-12037The Post Form – Registration Form – Profile Form for User Pr…6.4
• CVE-2024-12038The Post Form – Registration Form – Profile Form for User Pr…5.4
• CVE-2024-12039langgenius/dify version v0.10.1 contains a vulnerability whe…8.1
• CVE-2024-1204The Meta Box WordPress plugin before 5.9.4 does not prevent…4.3
• CVE-2024-12041The Directorist: AI-Powered WordPress Business Directory Plu…5.3
• CVE-2024-12042The MStore API – Create Native Android & iOS Apps On The Clo…5.4
• CVE-2024-12043The Prime Slider – Addons For Elementor (Revolution of a sli…5.4
• CVE-2024-12044A remote code execution vulnerability exists in open-mmlab/m…9.8
• CVE-2024-12045The Essential Blocks – Page Builder Gutenberg Blocks, Patter…4.8
• CVE-2024-12046The Medical Addon for Elementor plugin for WordPress is vuln…4.3