CVE-2024-3849 is a Local File Inclusion vulnerability (CWE-98) in the Click to Chat – HoliThemes WordPress plugin versions up to 3.35. The flaw permits authenticated attackers with contributor-level access or above to include arbitrary files on the server via improper control of filename inputs in include/require statements. This can lead to execution of arbitrary PHP code, enabling privilege escalation, data exposure, or full code execution on the affected server. The CVSS 3.1 base score is 8.8, reflecting high severity with network attack vector, low attack complexity, and privileges required at the contributor level.

Successful exploitation allows attackers to execute arbitrary PHP code on the server, bypass access controls, and access or modify sensitive data. The vulnerability affects the confidentiality, integrity, and availability of the affected system. Given the contributor-level privileges required, the threat is significant in environments where such user roles are assigned.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict contributor-level access to trusted users only and monitor for suspicious activity related to file uploads or inclusion. Avoid uploading files that could be interpreted as executable PHP code. Follow updates from HoliThemes for a security patch.