CVE-2024-54374 HIGH

CVE-2024-54374: WordPress Sogrid plugin <= 1.5.6 - Local File Inclusion vulnerability

Vendor Sabri

Product Sogrid

Weakness CWE-22 · Path traversal

Published December 16, 2024

Last update May 11, 2026

View on NVD All CVEs

CVSS base score

7.5/10

Attack vector Network

Attack complexity High

Privileges required None

User interaction Required

Confidentiality High

Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Sabri Sogrid sogrid allows PHP Local File Inclusion.This issue affects Sogrid: from n/a through <= 1.5.6.

Explanation of Vulnerability in Simple Terms

02Summary

Sogrid versions up to 1.5.6 contain a path traversal vulnerability that allows attackers to read or modify files on the server. An attacker must trick a user into visiting a malicious link or page. This can expose sensitive configuration files, database credentials, or allow modification of application files.

What an attacker can do

03Attacker Capabilities

Read or modify files on the server outside the intended directory.

Potential impact on your site

04Site Impact

Attackers could steal credentials, configuration data, or alter application files if a user is tricked into clicking a link.

Conditions required to exploit

05Prerequisites

User must click a malicious link or visit an attacker-controlled page.

Key dates

06Disclosure timeline

December 16, 2024 CVE published

May 11, 2026 Record updated

External resources

07References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2024-54374 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/22.html AskarLabs — CWE-22 write-up Path Traversal

Related vulnerabilities