CVE-2024-11429 is a Local File Inclusion vulnerability (CWE-98) in the premio Stars Testimonials WordPress plugin, affecting all versions up to 3.3.3. The flaw exists in the handling of the 'stars-testimonials-with-slider-and-masonry-grid' shortcode, allowing authenticated users with at least contributor privileges to control the filename used in an include/require PHP statement. This improper control enables attackers to include arbitrary PHP files, potentially leading to remote code execution and data exposure.

Successful exploitation allows an authenticated attacker with contributor-level access or higher to execute arbitrary PHP code on the server. This can result in bypassing access controls, unauthorized data access, and full server compromise if malicious PHP files are uploaded and included. The CVSS score of 8.8 reflects a high severity with network attack vector, low attack complexity, and significant confidentiality, integrity, and availability impacts.

No official patch or fix is currently available for this vulnerability. Users should restrict contributor-level access and higher to trusted individuals only until a vendor patch is released. Monitor the vendor's advisory channels for updates and apply any official fixes promptly once available. Avoid uploading PHP files or other executable content through the plugin or other means to reduce risk.