CVE-2024-6228

Name of the Vulnerable Software and Affected Versions Notifications for Forms & WordPress Actions versions prior to 2.6

Description Authenticated users with subscriber-level access and above can include and execute arbitrary local PHP files on the server. This occurs because the plugin fails to validate a user-supplied value used to construct a server-side file inclusion path. Server-side file inclusion is a flaw that allows an attacker to force the application to include a file from the local file system.

Recommendations Update to version 2.6 or later.