CVE-2024-12811 is a Local File Inclusion vulnerability in the Traveler WordPress theme (ShineTheme) affecting all versions up to 3.1.9. The flaw arises from improper control of filenames in include/require statements used in shortcodes, allowing authenticated users with contributor or higher privileges to include arbitrary files on the server. This can lead to execution of arbitrary PHP code, enabling attackers to bypass access controls, access sensitive data, or achieve remote code execution if PHP files are uploaded and included.

Successful exploitation allows authenticated contributors or higher to execute arbitrary PHP code on the server, potentially leading to full compromise of the web application, unauthorized data access, and bypass of access controls. The vulnerability has a high impact on confidentiality, integrity, and availability as reflected by the CVSS score of 8.8.

No official patch or fix is currently provided by the vendor. Users should restrict contributor-level permissions and above to trusted users only and monitor for suspicious activity. Check the vendor advisory regularly for updates or patches. Avoid uploading PHP files or any files that could be executed by the server until a fix is available.