CVE-2024-3813 is a Local File Inclusion vulnerability in the tagDiv Composer plugin for WordPress, affecting all versions up to and including 4.8. The flaw arises from improper control of the filename used in an include/require statement via the 'block_template_id' attribute of the 'td_block_title' shortcode. Authenticated attackers with contributor or higher privileges can leverage this to include arbitrary files, potentially executing PHP code on the server. This vulnerability can be exploited to bypass access controls and access sensitive data or achieve remote code execution if PHP files can be uploaded and included.

Successful exploitation allows an authenticated user with contributor-level permissions or higher to execute arbitrary PHP code on the server. This can lead to full compromise of the affected WordPress site, including bypassing access controls, unauthorized data disclosure, and remote code execution. The CVSS score of 8.8 reflects a high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict contributor-level and higher user permissions carefully and consider disabling or removing the tagDiv Composer plugin if not essential. Monitor vendor channels for updates and apply patches promptly once available.