CVE-2024-10516 is a path traversal vulnerability (CWE-22) in the Swift Performance Lite WordPress plugin affecting all versions up to 2.3.7.1. The issue resides in the 'ajaxify' function, which improperly restricts pathname input, enabling unauthenticated attackers to perform local PHP file inclusion. This allows arbitrary PHP code execution on the server, potentially leading to full compromise including access control bypass and sensitive data exposure. The vulnerability has a CVSS 3.1 base score of 8.1, indicating high severity. No patch or official remediation has been documented as of the published date.

Successful exploitation permits unauthenticated attackers to include and execute arbitrary PHP files on the affected server. This can result in remote code execution, bypass of access controls, and unauthorized access to sensitive data. The vulnerability affects the confidentiality, integrity, and availability of the system, as reflected by the CVSS vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H). No known exploits in the wild have been reported yet.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or limiting access to the vulnerable 'ajaxify' functionality or the Swift Performance Lite plugin itself. Monitoring for updates from the vendor (swte) is critical to apply any forthcoming patches promptly.