CVE-2024-32523 HIGH

CVE-2024-32523: WordPress Mailster plugin <= 4.0.6 - Unauthenticated Local File Inclusion vulnerability

Vendor Everpress

Product Mailster

Weakness CWE-98 · PHP file inclusion

Published May 17, 2024

Last update May 11, 2026

View on NVD All CVEs

CVSS base score

8.1/10

Attack vector Network

Attack complexity High

Privileges required None

User interaction None

Confidentiality Low

Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:L

What the vulnerability does

01Description

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in EverPress Mailster mailster.This issue affects Mailster: from n/a through <= 4.0.6.

Explanation of Vulnerability in Simple Terms

02Summary

Mailster versions up to 4.0.6 contain a code injection vulnerability that allows attackers to execute arbitrary code on the site without authentication. The vulnerability stems from insufficient input validation in a critical function. Attackers can exploit this over the network, though the attack requires specific conditions to succeed. This affects confidentiality, integrity, and availability of the site.

What an attacker can do

03Attacker Capabilities

Run their own code on the site to modify data, steal information, or disrupt service.

Potential impact on your site

04Site Impact

Attackers can compromise your site's data, modify content, steal user information, or take the site offline.

Conditions required to exploit

05Prerequisites

Network access to the site; no authentication required, but attack complexity is high.

Key dates

06Disclosure timeline

May 17, 2024 CVE published

May 11, 2026 Record updated

External resources

07References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2024-32523 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/98.html AskarLabs — CWE-98 write-up PHP Remote File Inclusion

Related vulnerabilities