CVE-2024-27971 HIGH

CVE-2024-27971: WordPress Premmerce Permalink Manager for WooCommerce plugin <= 2.3.10 - Local File Inclusion vulnerability

Vendor Premmerce
Product Premmerce Permalink Manager for WooCommerce
Weakness CWE-98 · PHP file inclusion
Published May 17, 2024
Last update May 11, 2026
View on NVD All CVEs

CVSS base score

8.3/10
Attack vector Network
Attack complexity High
Privileges required None
User interaction Required
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

What the vulnerability does

01Description

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Premmerce Premmerce Permalink Manager for WooCommerce woo-permalink-manager.This issue affects Premmerce Permalink Manager for WooCommerce: from n/a through <= 2.3.10.

Explanation of Vulnerability in Simple Terms

02Summary

Premmerce Permalink Manager for WooCommerce versions 2.3.10 and earlier contain a vulnerability that allows an attacker to execute arbitrary code on the site. The attack requires the victim to visit a malicious link or page, and can affect the entire WordPress installation. Site administrators should update to a version newer than 2.3.10 immediately.

What an attacker can do

03Attacker Capabilities

Run arbitrary code on the WordPress site, potentially compromising the entire installation.

Potential impact on your site

04Site Impact

Complete site compromise possible, including data theft, malware injection, and loss of control over the WordPress installation.

Conditions required to exploit

05Prerequisites

Victim must click a malicious link or visit an attacker-controlled page; no authentication required.

Key dates

06Disclosure timeline

May 17, 2024 CVE published
May 11, 2026 Record updated