CVE-2024-13408 is a Local File Inclusion vulnerability (CWE-98) in the WordPress plugin 'Post Grid, Slider & Carousel Ultimate – with Shortcode, Gutenberg Block & Elementor Widget' affecting all versions up to 1.6.10. The flaw arises from improper control of the filename in the 'theme' attribute of the pgcu shortcode, allowing authenticated attackers with Contributor-level privileges or higher to include arbitrary files on the server. This can result in execution of arbitrary PHP code, potentially leading to privilege escalation, data exposure, or full code execution on the affected server. The vulnerability has a CVSS v3.1 base score of 7.5, indicating high severity. No patch or vendor advisory is provided in the input, and no known exploits are reported in the wild.

Successful exploitation allows authenticated users with Contributor-level access or higher to include and execute arbitrary PHP files on the server. This can lead to bypassing access controls, unauthorized disclosure of sensitive information, and remote code execution. The impact affects confidentiality, integrity, and availability of the affected system. The high CVSS score reflects the significant risk posed by this vulnerability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Contributor-level access and above to trusted users only. Monitor for updates from the plugin vendor or WordPress security channels for patches addressing this vulnerability. Avoid uploading PHP files that could be included via the vulnerable shortcode attribute.