CVE-2024-3564 is a Local File Inclusion vulnerability in the Content Blocks (Custom Post Widget) WordPress plugin (versions up to 3.3.0). It arises from improper control of filenames used in include/require statements (CWE-98). The flaw allows authenticated attackers with contributor or higher privileges to include arbitrary files via the 'content_block' shortcode, enabling execution of PHP code within those files. This can result in privilege escalation, data disclosure, and remote code execution on the server hosting the plugin.

Successful exploitation allows attackers with contributor-level access or above to execute arbitrary PHP code on the server, bypass access controls, and access sensitive data. The vulnerability has a high CVSS score of 8.8, reflecting its potential for severe impact including full system compromise. There are no known exploits in the wild at the time of publication.

Patch status is not yet confirmed — no official fix or patch links are provided by the vendor. Users should monitor the vendor's advisory for updates and apply any official patches once available. Until then, restrict contributor-level access to trusted users only and consider disabling or removing the vulnerable plugin to prevent exploitation.