CVE-2024-6228: Local File Inclusion in Notifications for Forms & WordPress Actions Plugin (v2.6 Patch)

Technical summary

CVE-2024-6228 is a Local File Inclusion (LFI) vulnerability in the Notifications for Forms & WordPress Actions WordPress plugin prior to version 2.6. The plugin fails to properly sanitize user-supplied input before using it in a server-side file path construction operation. This allows authenticated attackers with subscriber-level or higher roles to include and execute arbitrary PHP files stored on the server filesystem. The vulnerability requires network access and an existing user account but no additional interaction, resulting in a CVSS 3.1 score of 7.5 (HIGH). The attack surface is limited by the need for valid credentials, but once inside the WordPress environment, an attacker can pivot toward full code execution and lateral movement.

Business impact

Exploitation allows attackers to execute arbitrary PHP code within the context of the WordPress application, potentially leading to complete server compromise. Depending on server configuration and file permissions, an attacker could read sensitive configuration files (wp-config.php containing database credentials), modify website content, inject malware, exfiltrate user data, or establish persistent backdoors. For multi-tenant or shared hosting environments, this could enable cross-site attacks affecting neighboring WordPress installations. The vulnerability is particularly damaging because it requires only subscriber-level access—a low-privilege account role that many WordPress sites issue liberally for authors, contributors, or customer accounts.

Affected systems

The vulnerability affects the Notifications for Forms & WordPress Actions WordPress plugin in all versions before 2.6. The vulnerability requires an active WordPress installation with the vulnerable plugin enabled and at least one user account with subscriber-level access or above. Sites with user registration disabled or strictly controlled access may have reduced exposure, but the vulnerability still exists in the codebase. Version 2.6 and later contain the remediation.

Exploitability

The vulnerability is exploitable by low-privilege authenticated users. An attacker must first obtain or create a subscriber account on the target WordPress site—achievable through public registration if enabled, phishing, credential reuse, or insider access. Once authenticated, no complex exploitation steps are required; the attacker simply crafts a malicious request targeting the unvalidated input parameter to include and execute a PHP file. The attack does not require special network positioning (AV:N) and exploitability is somewhat constrained by attack complexity (AC:H), likely due to specific conditions around file inclusion paths or server configuration. No known public exploits are currently listed in CISA's Known Exploited Vulnerabilities catalog.

Remediation

Immediately update the Notifications for Forms & WordPress Actions plugin to version 2.6 or later. This version addresses the input validation flaw. Site administrators should verify the plugin update through the WordPress dashboard (Plugins > Installed Plugins) and confirm the version number post-update. Additionally, audit user accounts to ensure only necessary accounts hold subscriber or higher roles, and disable open user registration if it is not required for your site's functionality.

Patch guidance

Update the plugin via the WordPress admin dashboard: navigate to Plugins > Installed Plugins, locate Notifications for Forms & WordPress Actions, and click Update to version 2.6 or later. Verify the update was successful by checking the plugin version in Plugins > Installed Plugins or by inspecting the plugin's readme.txt or main plugin file. If automatic updates are not enabled, manually download version 2.6+ from the WordPress plugin repository and upload via Plugins > Add New > Upload Plugin. After patching, restart any cache layers and confirm the site functions normally. For managed WordPress hosting, contact your provider to confirm the update has been applied across all instances.

Detection guidance

Monitor for suspicious file inclusion attempts in web server logs, particularly POST requests containing parameters with path traversal sequences (../, ..\ ) or file:// references targeting the vulnerable plugin. Check access logs for requests to the plugin's main file or known vulnerable endpoints with unexpected parameter values. In WordPress, enable security logging via a security plugin (e.g., Wordfence, Sucuri) to detect authentication events followed by unusual file system or database activity. Scan the WordPress plugin directory to confirm the installed version is 2.6 or later. Search for unexpected PHP files in the WordPress root, wp-content, or uploads directories that may have been included or executed as part of an attack. Review database logs for queries indicating data exfiltration or privilege escalation attempts.

Why prioritize this

This vulnerability merits immediate patching due to the combination of HIGH severity (CVSS 7.5), ease of exploitation once a subscriber account exists, and the potential for full server compromise. The plugin's widespread use in WordPress ecosystems and the simplicity of obtaining a low-privilege account make this a practical attack vector. The lack of user interaction requirements (UI:N) and the broad impact on confidentiality, integrity, and availability (C:H, I:H, A:H) underscore the urgency. Organizations with customer-facing WordPress sites or multi-user environments should treat this as critical.

Risk score, explained

The CVSS 3.1 score of 7.5 (HIGH) reflects the attack's requiring valid credentials (PR:L reduces severity from Critical), balanced against the high impact across confidentiality, integrity, and availability. The score assumes a network attack vector and does not require user interaction once the attacker is authenticated. Attack complexity is rated as High, likely because successful exploitation depends on specific server configurations or file permissions that may vary between deployments. The overall rating prioritizes this above medium-severity vulnerabilities but below remote unauthenticated critical flaws; however, in practice, the low barrier to obtaining subscriber accounts means the true risk to many WordPress sites is substantially higher.

Frequently asked questions