CVE-2024-43328 is a CWE-22 path traversal vulnerability in the WPDeveloper EmbedPress plugin for WordPress, affecting versions through 4.0.9. The flaw allows an attacker to perform PHP Local File Inclusion by bypassing restrictions on file pathnames, potentially leading to full system compromise. The CVSS 3.1 base score is 8.3, reflecting high impact on confidentiality, integrity, and availability. The vulnerability requires network access, has high attack complexity, no privileges required, and user interaction is needed. The scope is changed, indicating impact beyond the vulnerable component. No official patch or vendor advisory is currently available, and no exploits are known in the wild.

Successful exploitation of this vulnerability can lead to local file inclusion via PHP, resulting in full compromise of confidentiality, integrity, and availability of the affected system. Attackers may read sensitive files, execute arbitrary code, or disrupt service. The CVSS score of 8.3 indicates a high impact. However, no known exploits have been reported in the wild so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or restricting access to the EmbedPress plugin to mitigate risk. Monitor vendor channels for updates and apply patches promptly once available.