CVE-2024-8252

The vulnerability present in the Clean Login plugin for WordPress is characterized by a Local File Inclusion (LFI) flaw that affects all versions up to and including 1.14.5. This issue arises from improper handling of the 'template' attribute within the clean-login-register shortcode. When an authenticated user, with Contributor-level access or higher, manipulates this attribute, they can potentially include arbitrary files from the server. This capability allows attackers to execute PHP code embedded within those files, leading to severe security implications. The flaw is particularly concerning as it does not require administrative privileges, thus broadening the attack surface to a wider range of users who may have limited access rights.

Exploitation of this vulnerability can occur through various attack vectors. An authenticated attacker can craft a malicious request that leverages the shortcode to include a file from the server's filesystem. For instance, by specifying a path to a PHP file that contains malicious code, the attacker can execute arbitrary commands on the server. This could be achieved by uploading a seemingly harmless file, such as an image, that contains PHP code, and then using the LFI vulnerability to include and execute it. Furthermore, the attacker may also leverage this flaw to read sensitive configuration files, such as wp-config.php, which could expose database credentials and other critical information.

The real-world impact of this vulnerability can be significant, especially for organizations that rely on the Clean Login plugin for user authentication. Successful exploitation could lead to unauthorized access to sensitive data, including user information and administrative functionalities. Additionally, attackers could manipulate the server environment, leading to further compromises, such as the installation of backdoors or malware. The business risks associated with such breaches include reputational damage, financial losses due to remediation efforts, and potential legal ramifications stemming from data protection regulations. Organizations may also face operational disruptions as they work to mitigate the effects of an attack.

To effectively detect and mitigate this vulnerability, organizations should implement a multi-layered security approach. Regularly updating the Clean Login plugin to the latest version is crucial, as it often includes patches for known vulnerabilities. Additionally, employing web application firewalls (WAFs) can help filter out malicious requests that attempt to exploit the LFI flaw. Monitoring server logs for unusual access patterns or attempts to include unauthorized files can also aid in early detection of potential exploitation attempts. Furthermore, restricting user permissions and adhering to the principle of least privilege can minimize the risk of exploitation by limiting the capabilities of authenticated users.

In conclusion, the Local File Inclusion vulnerability in the Clean Login plugin poses a significant threat to WordPress installations, particularly due to its accessibility to users with lower privilege levels. The potential for unauthorized file execution and data exposure necessitates immediate attention from organizations utilizing this plugin. By adopting proactive detection and mitigation strategies, organizations can safeguard their systems against this and similar vulnerabilities, thereby enhancing their overall security posture.

CSURFACE threat intelligence has detected a marked escalation in exploitation attempts targeting the Local File Inclusion vulnerability in the Clean Login WordPress plugin. Our telemetry indicates a significant upward trend in activity, with the Exploit Prediction Scoring System (EPSS) score more than tripling, reflecting heightened attacker interest and increased likelihood of exploitation in the near term. This surge suggests that threat actors are actively probing or attempting to leverage this vulnerability, potentially to execute arbitrary PHP code via authenticated accounts with Contributor-level privileges or higher. Although no new exploit variants or publicly disclosed proof-of-concept code have emerged, the sharp increase in exploitation signals an elevated risk environment for organizations using affected plugin versions. Defenders should recognize that this vulnerability is transitioning from theoretical risk to active threat, underscoring the urgency of monitoring and response efforts. Consequently, the threat level associated with CVE-2024-8252 has intensified, warranting heightened vigilance given the expanded attack surface and the potential for privilege escalation and unauthorized code execution.

Update 2 — June 13, 2026

CSURFACE threat intelligence has identified a marked increase in the Exploit Prediction Scoring System (EPSS) score for CVE-2024-8252, rising by over 30%, despite a concurrent significant reduction in detection activity across our telemetry. This divergence suggests that while active exploitation attempts may be less frequently detected, the underlying risk and likelihood of exploitation remain elevated, potentially due to more targeted or stealthier attack methods that evade current detection mechanisms. The EPSS score now places this vulnerability near the top percentile of predicted exploitability, signaling that adversaries continue to prioritize this vector for gaining unauthorized code execution with Contributor-level access. This shift underscores a nuanced threat landscape where attackers may be refining their tactics to bypass defenses, increasing the challenge for defenders to identify and mitigate exploitation attempts promptly. Consequently, the threat level associated with CVE-2024-8252 should be considered heightened, reflecting an environment where the vulnerability is not only theoretically exploitable but increasingly leveraged in practice, necessitating enhanced monitoring and response capabilities.