CVE-2024-0844 - CVE House
Back to Database
Status published Medium CVE-2024-0844

The Popup More Popups, Lightboxes, and more popup modules plugin...

Vulnerability Description

The Popup More Popups, Lightboxes, and more popup modules plugin for WordPress is vulnerable to Local File Inclusion in version 2.1.6 via the ycfChangeElementData() function. This makes it possible for authenticated attackers, with administrator-level access and above, to include and execute arbitrary files ending with "Form.php" on the server , allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-0844

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

  • 0x9567b

References

More from devfelixmoira

View All →
CVE-2025-52791
WordPress Knowledge Base – Knowledge Base Maker plugin <= 1.1.8 - Cross Site Request Forgery (CSRF) Vulnerability
High 7.1
CVE-2024-54276
WordPress Poll Builder plugin <= 1.3.5 - Cross Site Scripting (XSS) vulnerability
Medium 6.5
CVE-2022-4533
Limit Login Attempts Plus <= 1.1.0 - IP Address Spoofing to Protection Mechanism Bypass
Medium 5.3

Affected Vendor

devfelixmoira

View all reports →

Affected Software

Popup More Popups, Lightboxes, and more popup modules
Vulnerable Versions:
2.1.6

Timeline

Official Publish: February 2nd, 2024
Last Modified: August 1st, 2024
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.